Skip to content
Hermes Codex

CVE-2026-93616: Check Point Multi-Domain Security Management Web Service Traversal and RCE

HERMES

HERMES THREAT SCORE & ENTERPRISE RISK EXPOSURE

Target: Enterprise Firewall Policy Orchestration Engine & Central Policy Database
Confidence: 98%
97 / 100
EXTREME

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown
Exploitability 20 / 20
Threat Activity 20 / 20
Weaponization 20 / 20
Exposure 19 / 20
Prevalence 18 / 20
Impact 20 / 20
Exploit Maturity 20 / 20
Attack Chain Potential 19 / 20
⚖️ Divergence & Operational Rationale

CVSS v3.1 calculates CVE-2026-93616 at 9.8 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Hermes Threat Score assigns a 97 (EXTREME) to account for confirmed in-the-wild targeted zero-day intrusions cataloged in CISA KEV on September 22, 2026. Because Check Point Multi-Domain Security Management Servers (MDSM) control firewall policies, VPN tunnels, and security definitions across hundreds of global domains, seizing the CPM daemon allows attackers to unilaterally push malicious policy updates to all managed enforcement points.

HASS

HASS AGENTIC SEVERITY & PERIMETER BOUNDARY IMPACT

Target: Enterprise Firewall Policy Orchestration Engine & Central Policy Database
Confidence: 95%
62 / 100
MODERATE

Measures specific systemic risk arising from autonomy, tool authority, and cascading execution.

Dimension Breakdown
Autonomy 15 / 20
Tool Access 16 / 20
Privilege 14 / 15
Persistence 13 / 15
External Impact 13 / 15
Propagation 13 / 15
⚖️ Divergence & Operational Rationale

Check Point MDSM acts as the authoritative source of truth for micro-segmentation and egress firewall rules protecting corporate infrastructure. Arbitrary execution on the management server allows attackers to silently introduce egress whitelist rules, permitting unauthorized LLM model weights exfiltration or covert command-and-control channels for rogue agents.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-93616: Check Point Multi-Domain Security Management Web Service Traversal and RCEVULNERABILITY

Connected Nodes: 1
Active Relationships (Outgoing)
→ affectsPRODUCTCheck Point Security Management
98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Check Point Security Management documented in Hermes dossier.”

Supporting Verified Evidence:

1. Technical Context & Affected Software Matrix

Section titled “1. Technical Context & Affected Software Matrix”

The Check Point Management (CPM) service is a Java-based daemon hosted on Check Point Gaia OS. It exposes web services on TCP port 19009 for communication with SmartConsole clients, automated API scripts, and high-availability synchronization peers.

ParameterTechnical SpecificationOperational Impact
CVE IdentifierCVE-2026-93616Check Point Advisory sk1000171 / CISA KEV Record
Vulnerability ClassPath Traversal (CWE-22) / Unrestricted File Upload (CWE-434)Arbitrary filesystem write outside restricted upload root
Vulnerable ComponentCPM Web Service (cpm.exe / Apache Tomcat) on TCP 19009Servlet dispatcher handling diagnostic and package uploads
Exploitation VectorCrafted HTTP multipart POST request with relative traversal in targetPathWriting arbitrary executable files into Tomcat webapps or classpath
Privileges RequiredNone (PR:N)Pre-authentication vulnerability on TCP port 19009
Privileges ObtainedRoot / admin in Gaia OS (uid=0)Complete administrative takeover of management database and gateways
Affected VersionsCheck Point Gaia OS R82.20, R82.10, R82, R81.20, R81.10Security Management, Multi-Domain Management, and SmartEvent servers
Fixed UpdatesJumbo Hotfix Accumulator Takes (R82 Take 127, R81.20 Take 170, R81.10 Take 192)Canonicalizes upload paths and enforces strict token-based auth

2. Vulnerability Anatomy & Root Cause Analysis

Section titled “2. Vulnerability Anatomy & Root Cause Analysis”

Unchecked Path Canonicalization in File Upload Servlet

Section titled “Unchecked Path Canonicalization in File Upload Servlet”

The issue is located in the CPM Web API endpoint exposed on port TCP 19009. The servlet responsible for handling file uploads (used by SmartConsole diagnostics and package distribution) failed to validate file path parameters against directory traversal characters before copying the uploaded input stream:

// Vulnerable file upload servlet in Check Point CPM Web Service
public void doPost(HttpServletRequest request, HttpServletResponse response) throws IOException {
    String clientProvidedPath = request.getParameter("targetPath");
    Part filePart = request.getPart("payload");


    // VULNERABILITY: No canonicalization or validation against directory traversal sequences
    File destination = new File("/opt/CPsuite-R82/fw1/conf/web/", clientProvidedPath);
    Files.copy(filePart.getInputStream(), destination.toPath(), StandardCopyOption.REPLACE_EXISTING);


    // If uploaded file is a .class or .jar in the classpath, it is dynamically loaded
    if (destination.getName().endsWith(".class")) {
        loadDynamicHandler(destination);
    }
}

By supplying a traversal string such as ../../../../opt/CPsuite-R82/tomcat/webapps/ROOT/webshell.jsp, an unauthenticated attacker escapes the intended sandbox directory /conf/web/. When written into the web application root or dynamic classpath, Tomcat immediately renders the JSP or executes the dynamic class handler under the high-privilege CPM service account (admin/root).

3. Attack Vectors & Forensic Execution Flow

Section titled “3. Attack Vectors & Forensic Execution Flow”
sequenceDiagram
    autonumber
    actor Attacker as Remote Attacker
    participant WebService as CPM Web API (TCP 19009)
    participant Servlet as File Upload Servlet
    participant FS as Gaia OS Filesystem
    participant JVM as CPM Tomcat / JVM Runtime
    participant Gateways as Managed Quantum Gateways


    Attacker->>WebService: POST /cpm/upload (targetPath=../../webapps/ROOT/cmd.jsp)
    WebService->>Servlet: Dispatch multipart upload request
    Servlet->>FS: Unvalidated write to Tomcat web root (StandardCopyOption.REPLACE)
    Note over FS: JSP webshell written to /opt/CPsuite-*/tomcat/webapps/ROOT/
    Attacker->>WebService: GET /cmd.jsp?cmd=id (TCP 19009)
    WebService->>JVM: Execute JSP under CPM service credentials (root)
    JVM-->>Attacker: Interactive administrative command output (uid=0)
    Attacker->>Gateways: Push backdoored firewall policy / export private VPN keys
  1. Network Reconnaissance: The adversary locates a Check Point Security Management Server or Multi-Domain Management Server with port TCP 19009 accessible from external or partner networks.
  2. Path Traversal Payload Delivery: The attacker issues a multipart HTTP POST request to /cpm/upload, setting the targetPath form field to traverse out of the staging folder and place a JSP payload into the Tomcat web application root directory.
  3. Arbitrary File Creation: The CPM servlet writes the uploaded stream directly to the target location on Gaia OS without canonicalizing the path or checking administrative authorization.
  4. Bytecode / Script Execution: The attacker triggers execution of the uploaded file by navigating to the newly created URI, obtaining shell execution in the context of the Java Virtual Machine running as admin/root.
  5. Global Security Policy Tampering: With root access on the MDSM, the attacker accesses the Postgres/Solr management database, extracts firewall credentials, establishes persistent VPN tunnels, and pushes modified security policies to all managed Quantum Gateways.

4. Forensic Investigation & Incident Response

Section titled “4. Forensic Investigation & Incident Response”

DFIR analysts investigating potential exploitation of CVE-2026-93616 on Check Point management servers should review the following indicators and logs:

Gaia OS Appliance Triage Commands

Section titled “Gaia OS Appliance Triage Commands”
Terminal window
# 1. Check CPM service status and child process trees
cpmstatus
cpstat mgmt -f processes


# 2. Inspect CPM web service log for upload servlet exceptions and traversal sequences
grep -E "upload|targetPath|\.\./" /opt/CPsuite-R*/fw1/log/cpm.elg


# 3. Scan Tomcat web applications for unauthorized JSP files or recent modifications
find /opt/CPsuite-*/tomcat/webapps/ -type f \( -name "*.jsp" -o -name "*.class" \) -mtime -7 -ls


# 4. Audit active listening sockets and foreign connections on TCP 19009
netstat -tulpn | grep 19009
ss -tanp | grep 19009


# 5. Review Gaia OS administrative login history and policy installation logs
tail -n 100 /var/log/messages | grep -E "cpm|fwm|install_policy"

5. Threat Hunting & Detection Engineering

Section titled “5. Threat Hunting & Detection Engineering”

Deploy the following multi-layer detection signatures across web application and network monitoring sensors:

title: Check Point Management Web Service Directory Traversal Upload
id: 93616c03-checkpoint-cpm-traversal01
status: critical
description: Detects suspicious path traversal attempts or unauthorized Java class uploads targeting Check Point CPM port 19009.
author: Hermes Codex Detection Engineering
date: 2026-09-22
logsource:
  category: webserver
  product: checkpoint_cpm
detection:
  selection_port:
    DestinationPort: 19009
  selection_traversal:
    cs-method: 'POST'
    cs-uri-query|contains:
      - '../'
      - '..\\'
      - '%2e%2e%2f'
      - '%2e%2e/'
  selection_extension:
    cs-uri-query|contains:
      - '.jsp'
      - '.class'
      - '.jar'
  condition: selection_port and (selection_traversal or selection_extension)
falsepositives:
  - Legitimate SmartConsole upgrade packages delivered through official interfaces.
level: critical
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026-93616

6. Remediation & Hardening Roadmap

Section titled “6. Remediation & Hardening Roadmap”

Official Jumbo Hotfix Accumulator

Section titled “Official Jumbo Hotfix Accumulator”

Apply the vendor security updates immediately per Check Point sk1000171:

  • For R82.20: Apply the dedicated Security Hotfix.
  • For R82.10: Install Jumbo Hotfix Accumulator Take 45 or higher.
  • For R82: Install Jumbo Hotfix Accumulator Take 127 or higher.
  • For R81.20: Install Jumbo Hotfix Accumulator Take 170 or higher.
  • For R81.10: Install Jumbo Hotfix Accumulator Take 192 or higher.

Operational Mitigations & Defensive Hardening

Section titled “Operational Mitigations & Defensive Hardening”
  1. Network Segmentation: Strictly restrict inbound access to TCP port 19009 to authorized management subnets and jump-hosts using perimeter firewall rules; never expose port 19009 to untrusted networks.
  2. Filesystem Integrity Auditing: Inspect /opt/CPsuite-*/fw1/conf/ and Tomcat web application roots for recently created .jsp, .class, or .sh files using integrity verification tools (md5sum against baseline).
  3. SmartConsole Access Control: Ensure Multi-Factor Authentication (MFA) is strictly enforced for all SmartConsole administrators connecting to the management server.

7. Correlated Research & Internal References

Section titled “7. Correlated Research & Internal References”

Sources & References

Section titled “Sources & References”