Check Point Security Management Server Zero-Day Exploited in Targeted Attacks

Check Point Software Technologies has confirmed that a previously unknown vulnerability in its Security Management Server was exploited in targeted attacks beginning July 23, 2026. According to the company, the flaw — tracked as CVE-2026-93616 — allows an attacker who can access the server's web service to execute arbitrary scripts without authentication.

The Security Management Server is a central component that controls firewall policies for Check Point's enterprise security portfolio. Successful exploitation could lead to full compromise of the firewall policy management infrastructure, potentially allowing attackers to modify security rules, redirect traffic, or pivot into protected networks.

Check Point released a security update on September 22, 2026, addressing the vulnerability. The company has not disclosed detailed exploitation mechanics beyond confirming that attacks were targeted and limited in scope, described as a "handful" of incidents. Security researchers and industry analysts recommend that all organizations running affected versions of the Security Management Server apply the patch immediately and review system logs for signs of compromise.