grep -nHP "login\(loginRequest=LoginRequest\{authenticationInfo=AuthenticationInfoBase\{username='[^']{1001,}'" "$MDS_FWDIR"/log/cpm.elg*
That command, published in Check Point’s advisory sk1000171, is the first thing an administrator should run on every Security Management Server this week. It searches for oversized login usernames in the management service logs — an artifact left behind by the exploitation of CVE-2026-93616, a pre-authentication path traversal that allows unauthenticated attackers to upload and execute arbitrary scripts on the Management Server, and load arbitrary Java classes, all without credentials.
The vulnerability carries a CVSS 9.8 score and affects the Quantum Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent. It does not touch Smart-1 Cloud, Firewall Appliances, or Spark Firewalls. Affected versions span the full management product line: R82.20 without the Jumbo Hotfix, R82.10 Take 44 or below, R82 Take 126 or below, R81.20 Take 166 or below, R81.10 Take 190 or below, and every legacy R80 and R81 release — all end-of-support.
Check Point released an R82.20 Security Hotfix and Jumbo Hotfix Accumulators for older branches. Standard LivePatch Take 28/29 does not address the flaw.
Two Months of Silent Exploitation
The vulnerability was not a theoretical finding. SecurityWeek reported that Check Point observed active exploitation beginning July 23, 2026 — two months before the public disclosure on September 22. The company confirmed a handful of customers were targeted in what it described as pinpointed attacks against management environments exposed to the internet without IP restrictions.
A second indicator of compromise also exists. Running grep -E "ERROR.*upgrade\.base\.ReflectionUtils.*Failed to load allResourceFiles map from" $MDS_FWDIR/log/cpm.elg* surfaces file paths containing directory traversal sequences — the literal exploitation signature. An example from the advisory shows a path like /opt/CPupgrade-tools-../../../../tmp/003193_VULNCHECK/scripts/upgrade_files.conf.
Why the Management Plane Is Different
Compromising a management server is not the same as bypassing a single firewall. The Check Point Security Management Server is the central control point for every firewall policy, access rule, log entry, and gateway configuration across the organization. An attacker with execution on this system holds administrative authority over the entire security perimeter — not one device, but all of them.
This is the second management plane zero-day Check Point has disclosed in three months. In July, CVE-2026-16232 allowed authentication bypass via a SmartConsole application token on the same class of infrastructure. Both incidents target the layer that governs everything else.
The September Trust Cluster
CVE-2026-93616 extends the September 2026 pattern of trust infrastructure failures that this beat has been tracking. The BlueMoon Patch-Gap showed how the gap between disclosure and patching becomes the attack surface. ADSys Trust-Store Poisoning demonstrated how a vendored script’s plaintext HTTP could compromise an entire enterprise trust store. Cisco ISE’s Nine-CVE disclosure hit identity infrastructure at scale. Each incident targets the foundational mechanisms organizations rely on to enforce security — and the management plane is where all of those mechanisms converge.
Remediation
CISA added CVE-2026-93616 to the Known Exploited Vulnerabilities catalog on September 22, triggering Binding Operational Directive 26-04. Federal agencies have until September 25 to remediate. CVE-2026-85102 — a separate VPN certificate bypass on Security Gateways — was added to the same KEV batch, making two critical Check Point vulnerabilities with a three-day federal deadline.
Organizations running affected versions should:
- Apply the R82.20 Security Hotfix or the appropriate Jumbo Hotfix Accumulator (R82.10 Take 45+, R82 Take 127+, R81.20 Take 170+, R81.10 Take 192+) immediately.
- Place the Management Server behind a Security Gateway or firewall and restrict TCP port 19009 to trusted IP addresses.
- Run both IoC grep commands against cpm.elg logs on every management, log, and SmartEvent server to check for historical exploitation during the two-month silent window.
- Check for FWM or MDS core dump files in /var/log/dump/usermode/ that coincide with suspicious login attempts.
The management server is the system that enforces security for everything else. When it is compromised, the perimeter it governs becomes transparent.