Check Point Patches Critical Zero-Day CVE-2026-93616 Enabling Unauthenticated Remote Code Execution on Management Servers
Check Point has patched a critical zero-day vulnerability identified as CVE-2026-93616 that permitted remote unauthenticated attackers to upload and execute arbitrary scripts on its management servers.
The flaw received a CVSS score of 9.8 and was exploited in targeted attacks first detected on July 23. Attackers combined directory traversal techniques with insecure file upload behavior to escape the designated directory and place scripts in locations where they would be automatically executed.
Affected Products
The vulnerability impacted core management and logging components responsible for security policy administration and log aggregation across an organization’s infrastructure:
- Security Management Server
- Multi-Domain Security Management Server
- Log Server
- Multi-Domain Log Server
- SmartEvent
Vulnerable versions include R82.20, R82.10 with Jumbo Hotfix Take 44 or earlier, R82 with Take 126 or earlier, R81.20 with Take 166 or earlier, R81.10 with Take 190 or earlier, and all R80.x and R81.x lines.
Remediation and Detection
Patches are available via the Security Hotfix for R82.20 and updated takes including R82.10 Take 45, R82 Take 127, R81.20 Take 170, and R81.10 Take 192 or later. In addition to applying fixes, Check Point recommends placing management servers behind a Security Gateway and restricting access to TCP port 19009 to trusted IP addresses only.
To identify potential compromise, administrators should examine the cpm.elg log for abnormally long usernames and ReflectionUtils errors containing directory traversal sequences.
Related articles
Blackbox Asset Management: Discovering and Identifying IT Infrastructure Without Direct Access
Security Vision expert Fedor Bokov explains how organizations can manage IT assets in blackbox mode when customers refuse to provide credentials or internal documentation. The approach begins with network scanning using tools such as nmap and masscan to detect live hosts and open ports across external and internal perimeters. Identification relies on banner grabbing, HTTP header analysis, favicon inspection, HTML structure, and service fingerprinting to determine exact software versions and operating systems. Examples include extracting Ubuntu 22.04 LTS details from an OpenSSH banner and identifying Checkpoint Gaia from specific HTTP responses on port 443. Further analysis of ports like 1433 and 443 reveals Microsoft SQL Server 2017, nginx 1.28.0, PHP 8.2.29, and Bitrix-Site-Manager instances. The methodology concludes with continuous monitoring cycles that track version changes, new services, and configuration deviations to prioritize vulnerability remediation without traditional inventory access.
GitLab Releases Security Updates Fixing 11 Vulnerabilities Including Two Critical Flaws
GitLab has issued critical security updates for its development platform to address 11 vulnerabilities across Community Edition and Enterprise Edition. The patches cover versions 19.4.1, 19.3.3, and 19.2.7 and were released on September 23, 2026. Two vulnerabilities rated Critical allow authenticated users to achieve arbitrary code execution on the server. CVE-2026-89078 involves a double-free issue in CI/CD configuration parsing triggered by crafted regular expressions, while CVE-2026-93577 is an integer overflow in the regular expression compiler. Additional High-severity issues include cross-site scripting in merge request diffs and unauthorized access to sensitive CI/CD variables via the Duo AI job troubleshooting feature. The update also resolves five Medium and two Low severity flaws.
Google Releases Chrome 154 with 108 Security Fixes Including 11 Critical Vulnerabilities
Google has published Chrome 154 for Windows, macOS, and Linux, addressing a total of 108 vulnerabilities. Eleven of these issues are rated Critical, covering buffer overflows in ANGLE, out-of-bounds writes in GPU, and multiple Use-After-Free flaws in ServiceWorker, Fullscreen, WindowDialog, AdFilter, and WebGL. Twenty-five High-severity issues were also fixed, including authorization problems in extensions, improper UI rendering in SecurityIndicators, and race conditions plus type confusion in the V8 JavaScript engine. Additional Medium and Low severity fixes bring the total to 108 patched flaws across components such as PDFium and WebAudio. The update is being rolled out over the coming days and weeks. Specific CVEs addressed include CVE-2026-95350, CVE-2026-95357, and CVE-2026-95281.
WordPress Patches Critical Core Vulnerability CVE-2026-87902 Affecting All Versions from 4.7.0
WordPress has released patches for a critical vulnerability in the platform's core code, tracked as CVE-2026-87902 with a CVSS score of 9.2. The flaw impacts every version from 4.7.0 through 7.1.1, meaning virtually all unpatched installations remain exposed. Because the issue resides in the base system rather than plugins or themes, even sites without any extensions installed are at risk. The vulnerability allows an unauthenticated attacker to load arbitrary PHP files from outside theme directories, which can lead to remote code execution on certain server configurations. The bug was privately reported in July by researcher Robert Ressl through HackerOne and disclosed publicly on 22 September, with no confirmed exploitation observed so far. Administrators are urged to apply the updates immediately and keep automatic updates enabled.