Check Point Security Management zero-day was exploited two months before a patch

Check Point disclosed and patched CVE-2026-93616 on September 22, 2026, a zero-day in the web service of its Security Management Servers, the consoles that push policy to Check Point firewalls. According to Daily Security Review and CSO Online, attackers exploited it in targeted operations as early as July 23, roughly two months before the fix. The flaw requires no authentication and can let an attacker run scripts on the management server; CSO reports it is rated CVSS 9.8 and was added to CISA's Known Exploited Vulnerabilities catalog on September 23.

A management server compromise is different from a single firewall compromise. The server controls policy for every gateway it manages, so an attacker could change firewall rules, pull network configuration data, or pivot to managed firewalls. CSO notes exploitation appears narrow so far, but the potential impact is broad.

If you use Check Point, confirm the September 22 fix is installed on each management server, and verify it manually rather than assuming automatic updates ran. Ask whether the management web interface is reachable from the internet; it should sit behind an allowlist or a dedicated admin network. Because exploitation preceded the patch, review management logs and policy change history from July 23 onward for unauthorized access or rule changes, and hunt for Check Point's published indicators.

The broader lesson applies to any vendor: security management consoles deserve the same patch urgency and access restrictions as the firewalls themselves, and ideally more.