CVE-2026-93616

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-93616 9.8

Check Point · Multiple Products · Added 2026-09-22 · Published 2026-09-22

3-Day Required KEV Automatable Active Exploitation

Details

VulnerabilityCheck Point Multiple Products Path Traversal Vulnerability

VendorCheck Point

ProductMultiple Products

Date added2026-09-22

Due date2026-09-25

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA's "Forensics Triage Requirements" (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-22

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts.

NVD: A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-09-22 20:15 UTC

Wall time0.6s

Searches1

Component defaultyes

Sources https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/
https://support.checkpoint.com/results/sk/sk1000171
https://thehackernews.com/2026/09/check-point-warns-of-management-server.html
https://www.bleepingcomputer.com/news/security/check-point-patches-management-server-zero-day-exploited-in-attacks/
https://securityonline.info/exploited-cve-2026-93616-checkpoint-scripts/
https://nvd.nist.gov/vuln/detail/CVE-2026-93616

Hunting hypothesis agent

Hunt network traffic to TCP port 19009 on Check Point Management Servers for HTTP requests with path traversal sequences (../ or ..%2f) and file upload POST bodies; monitor via WAF or network capture as default logs may not cover this port.

Research details

ComponentManagement web service (TCP port 19009)

PreconditionsUnauthenticated network access (TCP port 19009) to the Check Point Management web service. Affected versions: R82.20 with no Jumbo Hotfix, R82.10 Jumbo Hotfix Take 44 or below, R82 Jumbo Hotfix Take 126 or below, R81.20 Jumbo Hotfix Take 166 or below, R81.10 Jumbo Hotfix Take 190 or below (EOS), and all EoS versions R80 through R81. LivePatch Take 28/29 does not address this issue. agent

Public PoCno

Advisoryhttps://support.checkpoint.com/results/sk/sk1000171

Exploit notesPre-authentication path traversal combined with unrestricted file upload on TCP port 19009 allows arbitrary script execution. No public proof-of-concept exists, but targeted exploitation has been observed in the wild since July 23, 2026. Attackers upload malicious payloads via directory traversal to bypass restricted upload folders, then execute arbitrary scripts and load arbitrary Java classes. CVSS: 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

SummaryCVE-2026-93616 is a critical pre-authentication path traversal and file upload vulnerability in the Check Point Management web service (TCP port 19009) affecting Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent. An unauthenticated attacker can bypass upload restrictions via directory traversal to upload and execute arbitrary scripts and load arbitrary Java classes. Targeted exploitation was observed on July 23, 2026; a hotfix is now available and customers should apply it immediately.

Tia coverage

First reported2026-09-09

First exploit report2026-09-23

Exploit report → KEV1 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

a-critical-exploited-check-point-management-vulnerability-cve-20 check-point-warns-of-exploited-security-gateway-vpn-rce-cve-2026 cisa-2026-0908-cisa-adds-4-known-exploited-vulnerabilities-to-ca

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.