Check Point Security Management RCE exploited
CERT-FR warns of actively exploited RCE flaw CVE-2026-93616 in Check Point Security Management Server, requiring the R82.20 patch.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-93616 as exploited in the wild.
CERT-FR has issued an advisory regarding a vulnerability in Check Point's Security Management Server and Multi-Domain Security Management Server that allows remote code execution and data integrity compromise. The vendor confirms the flaw, tracked as CVE-2026-93616, is being actively exploited in the wild.
Affected systems are those running Security Management Server or Multi-Domain Security Management Server without the R82.20 patch. Check Point recommends restricting access to the administration interface and not exposing it to the Internet as an interim mitigation. Indicators of compromise are available in the vendor's advisory (sk1000171, published 22 September 2026).
Defenders operating Check Point Security Management infrastructure should apply the R82.20 patch immediately, audit exposure of the admin interface to the internet, and review the vendor-provided IOCs for signs of compromise given confirmed active exploitation.
Mentioned in this report
Detection guidance
Check Point Security Management Server Process Anomaly
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects suspicious child processes spawned by Check Point Security Management Server services, indicative of command execution following CVE-2026-93616 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Check Point Security Management Server Process Anomaly
description: Detects suspicious child process creation from Check Point Security Management
Server processes (java.exe, gwd.exe, etc.), which may indicate successful exploitation
of CVE-2026-93616 leading to remote code execution. Focuses on unusual command shells
or execution utilities spawned from normally passive management daemons.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection_checkpoint_parent:
ParentImage|endswith:
- \java.exe
- \gwd.exe
- \cpd.exe
- \cposd.exe
ParentCommandLine|contains:
- checkpoint
- mgmt
selection_suspicious_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \bash.exe
- \sh.exe
- \cscript.exe
- \wscript.exe
filter_legitimate_admin:
CommandLine|contains:
- CheckPoint
- SmartConsole
- CPSetup
condition: selection_checkpoint_parent and selection_suspicious_child and not filter_legitimate_admin
falsepositives:
- Check Point installation or configuration scripts that legitimately invoke shells
from parent services
- Monitoring agents deployed within Check Point processes
level: high
id: 23f8b829-0a7a-5276-83dc-fba8a2fbbc07
status: experimental
author: Vorant
Check Point Security Management Unpatched Version Detection
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects Check Point Security Management Server processes running versions prior to R82.20 patch, indicating systems vulnerable to CVE-2026-93616. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Check Point Security Management Unpatched Version Detection
description: Identifies Check Point Security Management or Multi-Domain Security Management
Server processes running vulnerable versions prior to R82.20. Matches version strings
in process command lines and file metadata to flag unpatched instances susceptible
to CVE-2026-93616 RCE.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection_checkpoint_process:
Image|endswith:
- \java.exe
- \cpd.exe
CommandLine|contains:
- checkpoint
- -DCP_VERSION
selection_vulnerable_version:
CommandLine|re: (R7[0-9]\.|R8[0-1]\.\d+|R82\.1[0-9])
filter_r8220_or_later:
CommandLine|re: (R82\.2[0-9]|R83\.|R84\.)
condition: selection_checkpoint_process and selection_vulnerable_version and not
filter_r8220_or_later
falsepositives:
- Development or test environments intentionally running older Check Point versions
- Version detection tools or scripts that invoke Check Point binaries to query their
version
level: medium
id: 0107ab77-6167-5037-a165-3605823e3f40
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1219
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs