One Port to Root: Weaponizing Check Point Management CVE-2026-93616
Reported exploitedCheck Point Security Management ServerCheck Point Multi-Domain Management ServerOur summary
Bishop Fox researchers detail a critical, actively exploited flaw in Check Point's Security Management and Multi-Domain Management servers, tracked as CVE-2026-93616 (CVSS 9.8). The bug allows an unauthenticated attacker reaching TCP port 19009 to spoof the server's own identity, obtain a privileged session, write arbitrary files as root, and ultimately execute code as root — compromising the system that stores firewall policy, admin credentials, and the internal certificate authority for an entire Check Point deployment. The researchers reproduced full root takeover against unpatched R81.10 and R82.10 systems and released a free scanner to check patch status remotely.
Check Point's advisory describes the issue only as a directory-traversal and file-upload flaw, but Bishop Fox found the vendor's hotfix actually closes three distinct defects, including the forged-login primitive that makes the other bugs reachable without authentication. Fixes ship in Jumbo Hotfix Accumulator R82.10 Take 45, R82 Take 127, R81.20 Take 170, R81.10 Take 192, and the R82.20 Security Hotfix; older R80–R81 branches remain unpatched and unsupported. Organizations are urged to apply the hotfix immediately, restrict access to port 19009 to trusted management hosts, and, for any exposed unpatched server, treat it as potentially already compromised and rotate credentials and certificates.
Below is the opening; the full story is at Bishop Fox.
From Bishop Fox
TL;DR
- The Check Point management server is the brain of a Check Point firewall estate: it holds the policy every gateway enforces, the administrator credentials, and the certificate authority the whole deployment trusts. A flaw already used in real attacks lets anyone who can reach that server take it over completely without logging in.
- CVE-2026-93616">CVE-2026-93616, scored 9.8 and exploited in the wild, lets an unauthenticated attacker write files as root on the Check Point Security Management and Multi-Domain Management servers, then turn that write into root code execution. Every step runs over one port, TCP 19009. We reproduced the attack end to end against unpatched R81.10 and R82.10 lab servers, confirming execution as root on both. Our CVE-2026-93616-check">detection tool reports patch state from outside with one benign request…
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.