Check Point discloses path traversal zero-day CVE-2026-93616 exploited July 23 on unpatched Security Management Servers

The vulnerability affects R82.20 with no Jumbo Hotfix, R82.10 Take 44 or lower, R82 Take 126 or lower, and R81.20 Take 166 or lower. Check Point issued fixes via Jumbo Hotfix and LivePatch on 22 September after confirming the July intrusions. No targets or post-exploitation actions were named in the advisory sk1000171. A separate VPN certificate flaw CVE-2026-85102 in Spark gateways saw exploitation attempts from 12 September using anonymizing infrastructure and CN=vpn certificates, despite fixes released 9 September.

Procurement records and prior Check Point incident patterns show management servers often remain at lower take numbers due to change-control windows in enterprise deployments. The July exploitation predates any public CVE and occurred while R82.10 and R82 releases still carried the earlier VPN flaw, creating overlapping exposure windows. NCSC-NL notices confirm Site-to-Site and Remote Access VPN configurations on Spark devices were reachable without prior authentication.

Independent verification of attribution remains absent; Check Point reports only technical indicators and anonymized infrastructure without linking to specific threat groups. The gap between LivePatch Take 28/29 (fixing CVE-2026-91843) and the higher takes required for CVE-2026-93616 leaves a measurable population of centrally managed gateways still vulnerable.

Administrators must audit current take numbers against sk1000171, deploy the listed fixes, and run the provided hunting queries. Continued monitoring of certificate subject anomalies on Spark VPN endpoints will indicate whether the September attempts expand beyond small-business deployments.