Posted on

Check Point Management CVE-2026-93616 – Actively Exploited Pre-Authentication Script Execution

Threat Overview

Check Point disclosed CVE-2026-93616 on September 22 after identifying a handful of targeted attacks on July 23. The flaw combines directory traversal and file upload in the Management web service and permits unauthenticated arbitrary script execution. CISA added it to KEV. Check Point states LivePatch Takes 28 and 29 do not fix this vulnerability.

References

Impacted Systems

Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server and SmartEvent. Affected reporting includes R82.20 without the Security Hotfix; R82.10 Take 44 and earlier; R82 Take 126 and earlier; R81.20 Take 166 and earlier; R81.10 Take 190 and earlier, plus older EoS branches. Fixes include R82.20 Security Hotfix, R82.10 Take 45, R82 Take 127, R81.20 Take 170 and R81.10 Take 192+. Smart-1 Cloud is already patched. TCP/19009 reachability is the key exposure condition.

Why this matters

The Management Server is the administrative control plane for Check Point environments. Pre-authentication code execution can expose policy, logging, administrative data, and the ability to affect managed security infrastructure.

Exploitation Status

Confirmed active exploitation. Check Point says it observed a handful of pinpointed attacks on July 23 before public disclosure and patch availability. No actor attribution, payload, or victim identity has been publicly confirmed.

What this hunt looks for

TCP/19009 access, path traversal, ReflectionUtils/allResourceFiles errors, Java child-process execution, script creation, new management-service sources, and unexpected outbound destinations.

Required logs

Check Point/network telemetry in CommonSecurityLog, management Syslog, and Defender XDR DeviceProcessEvents, DeviceFileEvents and DeviceNetworkEvents where available.

First Pass – TCP 19009 Access

CommonSecurityLog
| where TimeGenerated >= ago(90d)
| where DestinationPort == 19009
| project TimeGenerated,SourceIP,DestinationIP,SourcePort,DestinationPort,Protocol,DeviceAction,Message
| order by TimeGenerated desc

Management Path Traversal Indicators

CommonSecurityLog
| where TimeGenerated >= ago(90d)
| where DestinationPort == 19009 or RequestURL != ""
| where RequestURL has_any ("../","..%2f","%2e%2e","%252e") or Message has_any ("../","..%2f","%2e%2e","%252e")
| project TimeGenerated,SourceIP,DestinationIP,DestinationPort,RequestMethod,RequestURL,DeviceAction,Message
| order by TimeGenerated desc

ReflectionUtils / allResourceFiles Errors

Syslog
| where TimeGenerated >= ago(90d)
| where SyslogMessage has_any ("ReflectionUtils","allResourceFiles")
| project TimeGenerated,Computer,HostName,ProcessName,SeverityLevel,SyslogMessage
| order by TimeGenerated desc

Traversal Strings in Syslog

Syslog
| where TimeGenerated >= ago(90d)
| where SyslogMessage has_any ("../","..%2f","%2e%2e","19009")
| project TimeGenerated,Computer,HostName,ProcessName,SeverityLevel,SyslogMessage
| order by TimeGenerated desc

Java Spawning Shells

DeviceProcessEvents
| where Timestamp >= ago(90d)
| where InitiatingProcessFileName in~ ("java","java.exe")
| where FileName in~ ("sh","bash","dash","python","python3","perl","cmd.exe","powershell.exe","pwsh.exe")
| project Timestamp,DeviceName,AccountName,InitiatingProcessCommandLine,FileName,ProcessCommandLine,SHA256
| order by Timestamp desc

Management Script Creation

DeviceFileEvents
| where Timestamp >= ago(90d)
| where FileName endswith ".sh" or FileName endswith ".py" or FileName endswith ".pl" or FileName endswith ".class" or FileName endswith ".jar"
| where InitiatingProcessFileName in~ ("java","java.exe","cpwd","fwm","cpm")
| project Timestamp,DeviceName,ActionType,FileName,FolderPath,SHA256,InitiatingProcessFileName,InitiatingProcessCommandLine
| order by Timestamp desc

New Sources to TCP 19009

let Known=CommonSecurityLog
| where TimeGenerated between (ago(90d)..ago(7d))
| where DestinationPort == 19009
| summarize by SourceIP,DestinationIP;
CommonSecurityLog
| where TimeGenerated >= ago(7d)
| where DestinationPort == 19009
| join kind=leftanti Known on SourceIP,DestinationIP
| project TimeGenerated,SourceIP,DestinationIP,DestinationPort,DeviceAction,Message
| order by TimeGenerated desc

Management Host New Destinations

let Known=DeviceNetworkEvents
| where Timestamp between (ago(90d)..ago(7d))
| where DeviceName has_any ("management","smart","mds","log")
| summarize by DeviceId,RemoteIP,RemoteUrl;
DeviceNetworkEvents
| where Timestamp >= ago(7d)
| where DeviceName has_any ("management","smart","mds","log")
| join kind=leftanti Known on DeviceId,RemoteIP,RemoteUrl
| project Timestamp,DeviceName,InitiatingProcessFileName,RemoteUrl,RemoteIP,RemotePort
| order by Timestamp desc

Detection Notes

Highest-signal pivots are TCP/19009 access, traversal strings, and the vendor-described ReflectionUtils/allResourceFiles error pattern. Device* queries require endpoint telemetry on the management server. Replace hostname heuristics with a known asset list where possible. Check Point states LivePatch does not fix this issue.

Leave a comment