Check Point zero-day RCE actively exploited

23 September 2026 high vulnerability technology

A pre-auth path traversal in Check Point Security Management and Log Servers allows unauthenticated RCE and has been exploited since July 23, 2026.

NCSC-NL published an advisory for CVE-2026-93616, a pre-authentication directory-traversal vulnerability (CVSS 9.8) in the Check Point Management Web Service. The flaw allows unauthenticated attackers to execute arbitrary scripts from an arbitrary path, leading to remote code execution, and affects multiple Check Point Management and Logging components.

Check Point has confirmed active exploitation in the wild since 23 July 2026 and designated the issue a zero-day. Because the vulnerability is exploitable pre-authentication, exposure of the management interface to the internet significantly raises risk; Check Point specifically recommends restricting access to TCP/19009 to trusted IP addresses only. Check Point has released patches and published indicators of compromise to help organizations detect potential compromise.

Defenders running Check Point Security Management or Log Servers should apply the vendor updates immediately, restrict management interface access (particularly TCP/19009) to trusted networks, and check the published IoCs against logs for signs of prior exploitation dating back to July 2026.

Mentioned in this report

Vulnerabilities CVE-2026-93616KEV

Detection guidance

Check Point Management Web Service Directory Traversal Exploitation Attempt

ATT&CK T1190

Detects HTTP requests to Check Point Management Web Service (TCP/19009) containing directory-traversal sequences attempting to access arbitrary files outside the intended directory. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Check Point Management Web Service Directory Traversal Exploitation Attempt
description: Detects HTTP requests to Check Point Management Web Service containing
  directory-traversal patterns (../, ..\) commonly used to exploit CVE-2026-93616
  pre-authentication directory-traversal vulnerability.
tags:
- attack.t1190
logsource:
  category: proxy
  product: windows
detection:
  selection:
    DestinationPort: 19009
    http_request|contains:
    - ../
    - ..\
    - '%2e%2e/'
    - '%2e%2e\'
  filter_legitimate:
    http_request|contains: /api/v1/
  condition: selection and not filter_legitimate
falsepositives:
- Security scanning tools performing directory-traversal tests on authorized Check
  Point instances
- Vulnerability assessment tools with explicit authorization
level: high
id: 5d64da78-97a5-565c-939e-08f378013757
status: experimental
author: Vorant

Check Point Management Web Service Arbitrary Script Execution via Path Parameter

ATT&CK T1190

Detects HTTP requests to Check Point Management Web Service attempting to execute arbitrary scripts by specifying paths outside the legitimate application directory. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Check Point Management Web Service Arbitrary Script Execution via Path Parameter
description: Detects HTTP requests to Check Point Management Web Service (TCP/19009)
  containing script execution patterns that reference file paths outside the intended
  application scope, indicative of CVE-2026-93616 exploitation.
tags:
- attack.t1190
logsource:
  category: proxy
  product: windows
detection:
  selection:
    DestinationPort: 19009
    http_request|contains:
    - /etc/
    - /tmp/
    - \\windows\\
    - \\program files
  condition: selection
falsepositives:
- Legitimate administrative API calls that reference system paths for log collection
  or configuration backup
- Authorized third-party integrations querying system diagnostics
level: high
id: 160be6a9-0411-550c-981c-623e1373394c
status: experimental
author: Vorant

Check Point Management Web Service Pre-Authentication Access to Restricted Endpoints

ATT&CK T1083

Detects HTTP requests to Check Point Management Web Service on TCP/19009 from untrusted sources accessing endpoints known to require authentication, indicating potential pre-authentication exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Check Point Management Web Service Pre-Authentication Access to Restricted
  Endpoints
description: Detects HTTP requests to Check Point Management Web Service (TCP/19009)
  attempting to access administrative or configuration endpoints without valid authentication
  headers, consistent with pre-authentication directory-traversal exploitation patterns.
tags:
- attack.t1083
- attack.t1190
logsource:
  category: proxy
  product: windows
detection:
  selection:
    DestinationPort: 19009
    http_request|contains:
    - /admin
    - /config
    - /logs
    - /system
    - /status
  filter_authenticated:
    http_request|contains:
    - 'Authorization:'
    - 'Cookie:'
    - X-Auth-Token
  condition: selection and not filter_authenticated
falsepositives:
- Endpoint monitoring tools scanning Check Point instances without explicit auth headers
- Load balancers or health checks probing management service endpoints
- Internal vulnerability scanners configured to test pre-auth attack surfaces
level: medium
id: 6d7d8c88-75ab-5dd4-828f-f7bb995ff3ab
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0387.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free