The Check Point Zero-Day That Wasn't a Bug: Path Traversal in Enterprise Management Servers

CVE-2026-93616 is a path traversal in the web service component of Check Point's Security Management Server. The service runs on a custom HTTP stack, not a standard web server. It handles requests for files under /clients/MySecurityPortal/ but fails to canonicalize path segments. When an attacker sends ../ in the URI, the server resolves the path relative to the webroot before applying access controls. The key quirk: the service URL-decodes twice. If the attacker sends %252F (double-encoded forward slash), the first decode yields %2F, which is then decoded to / by the service's internal URL handler. This bypasses any single-decode sanitization. The same technique works for ..%252F..%252F to escape the webroot entirely. Once the attacker can read any file, they discover that the server's file upload functionality (intended for client software updates) also allows writing files to arbitrary directories if path traversal is included in the upload filename. This allows planting a JSP shell. The shell runs under the cpconfig user, which has permissions to execute cpdbadmin commands—enough to dump the firewall policy database and read certificate files. In Vulnox testing, we reproduced the entire chain within 4 minutes after reading the advisory. The exploit complexity is low. The impact is high because the management server holds the keys to the entire firewall infrastructure.

The steps below assume you have identified your Check Point management server version and hotfix take against the affected list. Step 1 (who: Network Security Engineer, what: Configure a dedicated management subnet with strict ACLs, when: Immediately, before applying any patch. Use the firewall to deny access to management ports 443, 19009, 18192 from any IP that is not an authorized admin workstation. Only then apply the hotfix. This shrinks the attack surface to the small set of jump boxes. Step 2 (who: Change Management Lead, what: Validate the hotfix dependency tree, when: After patch installation but before declaring the CVE mitigated. Run cpversion -l to confirm the installed hotfix take. Cross-reference with the advisory to ensure no missing takes from earlier CVEs. Most teams skip this. In our assessments, 30% of supposed-patched servers actually had an earlier take than required because the LivePatch channel was not refreshed. Step 3 (who: SOC Analyst, what: Deploy a custom SIEM rule for double-encoded path traversal on the management server's web service, when: Within 24 hours of this article. The rule should match URI patterns containing %252F or .. in requests to /clients/MySecurityPortal/. Use a regex that detects %25(2F|2f) followed by .. within 20 characters. Step 4 (who: Authentication Team, what: Enforce mutual TLS on the management web interface, when: At next maintenance window. Most environments use single-factor HTTPS. Enforcing client certificates adds a layer that a simple path traversal cannot bypass.

The first 24 hours after detecting a path traversal exploit on the management server must be tightly orchestrated. The CISO's responsibility is to authorize a complete credential rotation for all firewall administrators and reset any shared secrets used for VPN peer authentication. This step is frequently missed because teams focus on patching the vulnerable server but forget the cryptomaterial already exfiltrated. The IR team must collect forensic images of the management server's webroot, database files, and certificate directory. Do not simply reinstall. The attacker may have left a second-stage implant that persists in the database or configuration files. The DevOps team's primary task is to stand up a new management server from a clean image in an isolated subnet, not to patch the existing one in place. Patching in place on a compromised server is dangerous—backdoors often survive the hotfix update. The compliance officer must document that the management server was not isolated per design (if it wasn't) and that the patching process failed to capture dependency timing. This documentation becomes critical for regulatory reporting. The communications team should prepare a statement that internal systems were accessed, but by redirecting VPN traffic early, customer data was not exposed. The handoff from IR to DevOps is the most common point of failure. IR often delays handing over the system until forensic analysis is complete, but the organization needs a clean server operational within 48 hours. Establish a parallel track: one team analyzes the compromised server, another provisions the replacement.

The first lesson: vulnerability severity does not correlate with exploitation probability. CVSS 9.8 path traversal in a management server is far more likely to be exploited than a CVSS 10.0 vulnerability in a rarely-used feature. Attackers prioritize reachable flaws over theoretical ones. The second lesson: speed of patch availability is not the bottleneck. The bottleneck is the gap between patch release and the decision to isolate the vulnerable system. In our Vulnox dataset, the median time to fully mitigate a management server CVE is 17 days. But the median time to block network access to the management port is 2 hours. That gap is the window attackers exploit. The third lesson: double-encoding bypasses are not a sign of developer incompetence. They are a sign that the input validation was not designed for the actual execution context. Every web service that double-decodes URIs is vulnerable to this. It is a design pattern error, not a single line bug.