Check Point Security Management Server Zero-Day Exploited in Attacks: Emergency Hotfix Deployment and Threat Hunting Guide

Check Point Software has released emergency hotfixes for a critical vulnerability in its Security Management Server that allows an attacker to execute arbitrary scripts on the management plane. This is not a theoretical exposure: Check Point has confirmed the flaw is being exploited in the wild, and BleepingComputer's reporting indicates the fixes were pushed out-of-band specifically because weaponization was already underway.

For defenders, the severity here cannot be overstated. The Security Management Server (and its multi-domain variant, the Multi-Domain Server / MDS) is the brain of your Check Point estate. It holds your security policies, your gateway credentials, your administrator accounts, your logs, and in many environments the ability to push policy to every enforcement point you own. An attacker with arbitrary script execution on this host doesn't just have a foothold — they have the keys to silently weaken or rewrite the policy protecting your entire network, harvest credentials, and pivot into every segment your gateways touch.

If you operate a Check Point management plane, this is a patch-now, verify-after situation. The remainder of this post covers what we know about the vulnerability, how to detect post-exploitation behavior, and how to remediate.

Technical Analysis

Affected Components

Based on the vendor advisory and reporting:

• Affected product: Check Point Security Management Server (Standalone and distributed deployments), including Multi-Domain Server / Multi-Domain Log Server environments.
• Platform: Gaia OS (the hardened Linux-based operating system underlying Check Point management appliances, whether on Check Point hardware, open servers, or virtualized/cloud deployments such as Smart-1 Cloud-adjacent management).
• Impact: Remote execution of arbitrary scripts on the management server. In practical terms this means command execution in the context of the management services — which on Gaia-based management typically translates to a high-privilege context with access to policy databases, the internal CA, logs, and SIC (Secure Internal Communication) trust material.
• Fix delivery: Emergency hotfixes released out-of-band, ahead of the normal Jumbo Hotfix Accumulator (JHF) cadence. Hotfixes are version-specific — you must obtain the take that matches your installed release (R81.20, R81.10, R80.40-era trains should be checked against the advisory; consult sk180336-style Check Point Support Center entries and your account team for the exact SKU/take mapping for your environment).

How the Attack Works (Defender's View)

Check Point has kept exploit specifics deliberately thin — standard practice for an actively exploited flaw — but the published description ("run arbitrary scripts") combined with the affected component lets us reconstruct the defender-relevant attack chain:

1. Initial access: The attacker reaches an exposed management component — most commonly the Gaia Portal / SmartDashboard web services or a management API endpoint that is reachable beyond its intended administrative network. Management interfaces that are internet-reachable or reachable from broad internal segments are the primary risk surface.
2. Script execution: The flaw is abused to cause the management server to execute attacker-supplied script content. On Gaia, that means payloads typically landing as shell scripts or script interpreters invoked by management processes (e.g., children of cpwd, cpm, fwm, or the web services layer).
3. Post-exploitation: From there, observed tradecraft for management-plane compromises historically includes: harvesting of administrator credentials and SIC certificates, dumping the policy and user databases, creating rogue local admin accounts, staging tooling under writable paths such as /tmp, /var/log/tmp, or web-accessible directories, and establishing outbound C2 from a host that most egress filters implicitly trust.

Exploitation Status

• In-the-wild exploitation: Confirmed. Check Point's own warning language and the emergency, out-of-band nature of the hotfixes indicate active attacks, not a proof-of-concept race.
• CISA KEV: Monitor the CISA Known Exploited Vulnerabilities catalog — actively exploited network-infrastructure flaws of this class are routinely added, which carries a Binding Operational Directive remediation deadline for federal agencies and should be treated as a de facto deadline for everyone else.
• Attribution: No public attribution at time of writing. Management-plane compromises are a hallmark of both espionage-motivated actors and sophisticated criminal operators seeking to disable or blind security controls before a larger intrusion.

Detection & Response

Patching closes the door going forward — it does nothing for the attacker who walked through it last week. Because exploitation predates the hotfix, every organization running an affected management server should hunt for post-exploitation artifacts, not just deploy the fix.

The highest-fidelity signals for management-server compromise are: (1) management service processes spawning shells or script interpreters, (2) unexpected files in web-served or temp paths, and (3) outbound connections from the management host to destinations that are not Check Point update/TAC infrastructure.

SIGMA Rules

These rules target Gaia/Linux process-execution telemetry. If you are forwarding Gaia audit/syslog or running an EDR on management-adjacent Linux collectors, map accordingly.

---
title: Check Point Management Service Spawning Shell or Script Interpreter
id: 3f9c2a71-6b4e-4d58-a921-7e2b5f8d0c34
status: experimental
description: Detects Check Point management daemons (cpwd, cpm, fwm, cpwd_admin) spawning shells or script interpreters, consistent with arbitrary script execution on a compromised Security Management Server.
references:
  - https://www.bleepingcomputer.com/news/security/check-point-patches-management-server-zero-day-exploited-in-attacks/
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/cpwd'
      - '/cpm'
      - '/fwm'
      - '/cpwd_admin'
      - '/httpd'
      - '/java'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
  condition: all of selection_*
falsepositives:
  - Rare; legitimate Check Point maintenance scripts invoked during hotfix installation or cpuse operations. Correlate with change windows.
level: high
---
title: Suspicious Script or Binary Dropped in Gaia Temp or Web Paths
id: 8b1d4e62-9a3f-4c70-b5d2-2f6a9e1c7b45
status: experimental
description: Detects creation of executable script files in temporary or web-accessible directories on a Check Point management host, a common staging pattern after arbitrary script execution.
references:
  - https://www.bleepingcomputer.com/news/security/check-point-patches-management-server-zero-day-exploited-in-attacks/
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1105
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/tmp/'
      - '/var/tmp/'
      - '/dev/shm/'
      - '/web/htdocs/'
      - '/opt/CPshrd'
  selection_ext:
    TargetFilename|endswith:
      - '.sh'
      - '.py'
      - '.pl'
      - '.cgi'
      - '.jsp'
      - '.php'
  condition: all of selection_*
falsepositives:
  - Hotfix and JHF installation write scripts to temp paths. Filter by approved maintenance windows and Check Point-signed package paths.
level: high
---
title: Outbound Network Connection from Check Point Management Host to Non-Check Point Infrastructure
id: 5c7a9f13-2e6d-4b81-a3c4-9d1e6f8b2a57
status: experimental
description: Detects outbound connections initiated from the management server by non-standard processes. Management servers should primarily speak to gateways, SmartConsole clients, and Check Point cloud services — anything else is anomalous.
references:
  - https://www.bleepingcomputer.com/news/security/check-point-patches-management-server-zero-day-exploited-in-attacks/
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|endswith:
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/bash'
      - '/sh'
      - '/python'
      - '/python3'
      - '/perl'
    DestinationIp|cidr:
      - '0.0.0.0/0'
  condition: selection
falsepositives:
  - Administrators fetching packages during upgrades. Restrict by known Check Point update destinations and approved admin source hosts; tune destination allowlists per environment.
level: medium

KQL — Microsoft Sentinel / Defender

Most organizations ingest Gaia syslog into Sentinel via a Linux log forwarder (Syslog or CommonSecurityLog tables). The first query hunts for shells/interpreters launched from management-host processes via forwarded syslog; the second hunts for egress from the management host to rare destinations using firewall logs already in Sentinel.

// Hunt 1: Shell or script interpreter execution reported by Check Point management hosts via syslog
let MgmtHosts = dynamic(["mgmt01", "mds01", "smartcenter"] ); // replace with your management hostnames/IPs
Syslog
| where TimeGenerated > ago(14d)
| where HostName in~ (MgmtHosts) or Computer in~ (MgmtHosts)
| where ProcessName has_any ("bash", "sh", "python", "perl", "curl", "wget", "nc", "ncat")
   or SyslogMessage has_any ("/bin/sh", "/bin/bash", "python -c", "curl http", "wget http", "base64 -d")
| project TimeGenerated, HostName, ProcessName, SyslogMessage, SeverityLevel
| order by TimeGenerated desc;

// Hunt 2: Rare outbound destinations from the management server in firewall/CEF logs
let MgmtIPs = dynamic(["10.0.0.5"] ); // replace with your management server IPs
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where SourceIP in~ (MgmtIPs)
| where DeviceAction !in~ ("drop", "deny")
| where DestinationIP !startswith "10." and DestinationIP !startswith "192.168." and DestinationIP !startswith "172.16."
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by DestinationIP, DestinationPort, ApplicationProtocol
| order by ConnectionCount asc
| where ConnectionCount < 50;

Velociraptor VQL

If you can run a Velociraptor client or offline collector on the Gaia host (or a forensic image of it), this artifact enumerates suspicious process lineage and staged scripts in one pass.

-- Check Point Management Server post-exploitation hunt:
-- shells/interpreters parented by management services + staged scripts in temp/web paths
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE (
        Exe =~ '(?i)/(sh|bash|dash|python3?|perl|curl|wget|nc|ncat)$'
    AND CommandLine =~ '(?i)(http://|https://|base64|-c |/tmp/|/dev/shm/)'
      )
   OR CommandLine =~ '(?i)(cpwd|/opt/CPsuite|fwm|cpm).*\b(sh|bash|python|perl)\b'

-- Stage 2: recently created scripts in writable/web-served paths
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
    '/tmp/*.sh',
    '/var/tmp/*.sh',
    '/dev/shm/*',
    '/web/htdocs/**/*.cgi',
    '/web/htdocs/**/*.jsp',
    '/web/htdocs/**/*.php'
])
WHERE Mtime > ago('14d')
ORDER BY Mtime DESC

Remediation / Verification Script (Gaia clish + expert mode)

Run from expert mode on the management server. This does not install the hotfix (do that via CPUSE / Gaia Portal per the advisory) — it verifies your patch state, audits for the post-exploitation artifacts above, and tightens management-interface exposure.

#!/bin/bash
# check_point_mgmt_hardening_check.sh — run in expert mode on the Security Management Server
# Purpose: verify hotfix state, audit for post-exploitation artifacts, surface exposure risks.

echo "=== [1] Installed hotfix / JHF takes ==="
$CPDIR/bin/cpview_util hotfixes_list 2>/dev/null || clish -c "show installer packages installed"

echo "=== [2] Gaia OS and product version ==="
clish -c "show version all"

echo "=== [3] Management interface accessibility (should NOT be 0.0.0.0/any) ==="
clish -c "show management-interface" 2>/dev/null
clish -c "show sshd configuration" 2>/dev/null

echo "=== [4] Recent scripts staged in temp/web paths (last 14 days) ==="
find /tmp /var/tmp /dev/shm -type f \( -name '*.sh' -o -name '*.py' -o -name '*.pl' \) -mtime -14 -ls 2>/dev/null
find /web -type f \( -name '*.cgi' -o -name '*.jsp' -o -name '*.php' \) -mtime -14 -ls 2>/dev/null

echo "=== [5] Management-service child processes (shells/interpreters) ==="
for pid in $(pgrep -f 'cpwd|cpm|fwm|httpd'); do
  children=$(ps --ppid "$pid" -o pid=,comm= 2>/dev/null | grep -Ei 'sh|bash|python|perl|curl|wget')
  [ -n "$children" ] && { echo "Parent PID $pid:"; echo "$children"; }
done

echo "=== [6] Local admin accounts and recent additions ==="
clish -c "show users" 2>/dev/null
last -20 2>/dev/null

echo "=== [7] Recent outbound connections from non-standard processes ==="
netstat -antp 2>/dev/null | grep ESTABLISHED | grep -Ev 'fwm|cpd|fwd|cpview|postgres|java' | head -50

echo "=== [8] Crontab / scheduled persistence ==="
crontab -l 2>/dev/null; ls -la /etc/cron.d/ 2>/dev/null

echo "=== DONE. Compare hotfix list against the current Check Point advisory for this CVE. ==="

Remediation

1. Apply the emergency hotfix immediately. Obtain the version-matched hotfix from the Check Point Support Center advisory (sk) for this issue and install via CPUSE (Gaia Portal → Upgrades / CPUSE) or clish installer on every affected Security Management Server and Multi-Domain Server. Emergency hotfixes of this class are typically rolled into the next Jumbo Hotfix Accumulator take — confirm the fix is present in your JHF if you patch via the accumulator instead.
2. Verify management-interface exposure today. The Gaia Portal, SmartConsole (TCP/19009, 18190, etc.), and SSH should be reachable only from a dedicated management subnet/jump host — never from the internet, and never from general user VLANs. If your management interface is or was internet-exposed, treat the host as potentially compromised regardless of patch state.
3. Hunt before you trust. Because exploitation was confirmed before the fix shipped, run the detections above across at least the last 14–30 days of telemetry. Key artifacts: shells spawned by management daemons, scripts in /tmp//var/tmp//dev/shm/web paths, new local admin users, unexpected SIC resets, and outbound connections from the management host to non-Check Point destinations.
4. Rotate credentials and trust material. On any host with suspicious findings (or any host that was internet-exposed while vulnerable): rotate all Gaia/SmartDashboard administrator passwords, rotate API keys used against the management API, and reset SIC on gateways if management-server compromise is confirmed.
5. Restrict egress from the management plane. Management servers need to reach Check Point update/cloud services and your gateways — very little else. Explicit egress allowlisting both detects and disrupts C2 from this class of compromise.
6. Monitor CISA KEV and the vendor advisory. Watch the CISA Known Exploited Vulnerabilities catalog and Check Point's advisory for updated indicators, CVE assignment details, and any federal remediation deadlines — use a KEV listing (if issued) to drive internal SLA escalation.
7. If compromise is confirmed, engage IR. A compromised management server invalidates trust in every policy and credential it touched. Preserve disk and memory before remediation, scope lateral movement to gateways and SmartConsole clients, and treat downstream policy changes as untrusted until reviewed.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub