Check Point Revises Management Server RCE Advisory for Active Exploitation
Tech GuruQuick Answer
The authority published sk1000171 for Check Point Security Management Server, Multi-Domain Server, Log Server, Multi-Domain Log Server, and SmartEvent in affected R80 through R82.20 releases. Check Point's September 22 revision confirms in-the-wild exploitation of an unauthenticated directory-traversal and upload path that can execute arbitrary scripts on management servers, and publishes supported hotfix levels. Affected deployments should be matched to the authority's exact scope and moved to the supported fixed release.
Confirm Scope And Apply The Supported Fix
What to do now: Inventory Check Point Security Management Server, Multi-Domain Server, Log Server, Multi-Domain Log Server, and SmartEvent in affected R80 through R82.20 releases, match the exact affected release or feature, apply the authority-supported fixed build or service remediation, validate the dependent workflow, and preserve evidence.
Last verified: 2026-09-22 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Check Point Security Management Server, Multi-Domain Server, Log Server, Multi-Domain Log Server, and SmartEvent in affected R80 through R82.20 releases |
|---|---|
| Advisory | sk1000171 |
| CVE | CVE-2026-93616 |
| Authoritative release date | 2026-09-20 00:00:00 UTC |
| Authority revision date | 2026-09-22 15:33:41.200 UTC |
| Affected versions | R82.20 without its hotfix; R82.10 through Jumbo Hotfix Take 44; R82 through Take 126; R81.20 through Take 166; R81.10 through Take 190; and unsupported R80/R81 releases listed by Check Point. |
| Fixed version | R82.20 advisory hotfix; R82.10 Jumbo Hotfix Take 45+, R82 Take 127+, R81.20 Take 170+, or R81.10 Take 192+; replace end-of-support releases |
| CVSS base score | 9.8 (CVSS v3.1) |
| CVSS severity | Critical |
| Exploitation status | Known exploited: Check Point reports in-the-wild attacks against a limited number of customers; no exploitation claim is inferred. |
What Changed
Check Point's September 22 revision confirms in-the-wild exploitation of an unauthenticated directory-traversal and upload path that can execute arbitrary scripts on management servers, and publishes supported hotfix levels.
What To Validate Now
- Inventory. Locate Check Point Security Management Server, Multi-Domain Server, Log Server, Multi-Domain Log Server, and SmartEvent in affected R80 through R82.20 releases deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Compare each deployment with the authority's affected-version statement: R82.20 without its hotfix; R82.10 through Jumbo Hotfix Take 44; R82 through Take 126; R81.20 through Take 166; R81.10 through Take 190; and unsupported R80/R81 releases listed by Check Point. Do not infer applicability from product family or severity alone.
- Remediate. Apply R82.20 advisory hotfix; R82.10 Jumbo Hotfix Take 45+, R82 Take 127+, R81.20 Take 170+, or R81.10 Take 192+; replace end-of-support releases through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. Confirm the resulting version or managed-service state, exercise representative functionality and recovery paths, monitor for regressions, and document exceptions.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
