CVE-2026-93616
published 2026-09-22CVE-2026-93616: A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.
PriorityP197critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2026-09-25
Exploited in the wild
EPSS
75.87%
99.5th percentile
A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.
Affected
253 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| checkpoint | multi-domain_security_management | — | — |
| checkpoint | multi-domain_security_management | — | — |
| checkpoint | multi-domain_security_management | — | — |
| checkpoint | multi-domain_security_management | — | — |
| checkpoint | multi-domain_security_management | — | — |
| checkpoint | multi-domain_security_management | — | — |
| checkpoint | multi-domain_security_management | — | — |
| checkpoint | multi-domain_security_management | — | — |
| checkpoint | multi-domain_security_management | — | — |
| checkpoint | multi-domain_security_management | — | — |
| checkpoint | multi-domain_security_management | — | — |
| checkpoint | multi-domain_security_management | — | — |
| checkpoint | multi-domain_security_management | — | — |
| checkpoint | multi-domain_security_management | — | — |
| checkpoint | multi-domain_security_management | — | — |
| checkpoint | multi-domain_security_management | — | — |
| checkpoint | multi-domain_security_management | — | — |
| checkpoint | multi-domain_security_management | — | — |
| checkpoint | multi-domain_security_management | — | — |
| checkpoint | multi-domain_security_management | — | — |
| checkpoint | multi-domain_security_management | — | — |
| checkpoint | multi-domain_security_management | — | — |
| checkpoint | multi-domain_security_management | — | — |
| checkpoint | multi-domain_security_management | — | — |
| checkpoint | multi-domain_security_management | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Check Point Quantum Security Management up to R81 (EOS) path traversal
vuldb·2026-09-23·CVSS 9.8
CVE-2026-93616 [CRITICAL] Check Point Quantum Security Management up to R81 (EOS) path traversal
A vulnerability categorized as very critical has been discovered in Check Point Quantum Security Management up to R81 (EOS). This affects an unknown function. Such manipulation leads to path traversal.
This vulnerability is documented as CVE-2026-93616. The attack can be executed remotely. Additionally, an exploit exists.
GHSA
A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.
ghsa_unreviewed·2026-09-22
CVE-2026-93616 [CRITICAL] CWE-22 A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.
A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.
VulnCheck
Check Point Multiple Products Path Traversal Vulnerability
vulncheck·2026·CVSS 9.8
CVE-2026-93616 [CRITICAL] CWE-22 Check Point Multiple Products Path Traversal Vulnerability
Check Point Multiple Products Path Traversal Vulnerability
Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts.
Affected: Check Point Multiple Products
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet expos
VulnCheck
Check Point Multiple Products Improper Certificate Validation Vulnerability
vulncheck·2026·CVSS 9.8
CVE-2026-85102 [CRITICAL] CWE-295 Check Point Multiple Products Improper Certificate Validation Vulnerability
Check Point Multiple Products Improper Certificate Validation Vulnerability
Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation vulnerability which could allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.
Affected: Check Point Multiple Products
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each as
CISA
Check Point Multiple Products Path Traversal Vulnerability
cisa·2026-09-22·CVSS 9.8
CVE-2026-93616 [CRITICAL] CWE-22 Check Point Multiple Products Path Traversal Vulnerability
Vulnerability: Check Point Multiple Products Path Traversal Vulnerability
Affected: Check Point Multiple Products
Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's
No detection rules found.
Nuclei
Check Point Security Management - Unauthenticated Directory Traversal to RCE
nuclei·CVSS 9.8
CVE-2026-93616 [CRITICAL] Check Point Security Management - Unauthenticated Directory Traversal to RCE
Check Point Security Management - Unauthenticated Directory Traversal to RCE
Check Point Management Server contains a directory traversal and unrestricted file upload vulnerability allowing unauthenticated attackers to upload and execute arbitrary scripts remotely, exploit requires no authentication.
Template:
id: CVE-2026-93616
info:
name: Check Point Security Management - Unauthenticated Directory Traversal to RCE
author: 0x_Akoko,pdteam
severity: critical
description: |
Check Point Management Server contains a directory traversal and unrestricted file upload vulnerability allowing unauthenticated attackers to upload and execute arbitrary scripts remotely, exploit requires no authentication.
impact: |
Unauthenticated attackers can upload and execute arbitrary scripts, leading to full
Hackernews
Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes
blogs_hackernews·2026-10-02·CVSS 9.8
CVE-2026-104286 [CRITICAL] Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added a critical security flaw impacting Fortinet FortiMail to its Known Exploited Vulnerabilities ( KEV ) catalog, following reports of active exploitation.
The vulnerability, tracked as CVE-2026-104286 (CVSS score: 9.8), allows unauthenticated attackers to write arbitrary files on the underlying system.
"An improper limitation of a pathname to a restricted directory ('path traversal') [CWE-22] and improper neutralization of NULL byte or NULL chara
Checkpoint
28th September – Threat Intelligence Report
blogs_checkpoint·2026-09-28
CVE-2026-85102 28th September – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
AI Research 21
Android Malware 23
Artificial Intelligence 5
ChatGPT 3
Check Point Research Publications 474
Cloud Security 1
CPRadio 44
Crypto 2
Data & Threat Intelligence 2
Data Analysis 0
Demos 22
Global Cyber Attack Reports 426
How To Guides 13
Ransomware 6
Russo-Ukrainian War 1
Security Report 1
Threat and data analysis 0
Threat Research 175
Web 3.0 Security 11
Wipers 0
## 28th September – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 28th September, please download our Threat Intelligence Bulletin.
TOP ATTACKS AND BREACHES
The FBI
Hackernews
⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats
blogs_hackernews·2026-09-28·CVSS 9.8
CVE-2026-88771 [CRITICAL] ⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats
A domain used as harmless placeholder text showed up in roughly 1,700 repositories. Then somebody registered it and started serving malicious lures. That is the kind of week this was: forgotten assumptions turning into live attack surface.
Elsewhere, weak service accounts, old bugs, exposed systems, phishing kits, and strangely easy exploit paths kept doing useful work for attackers. Nothing exotic. Mostly things nobody expected to matter anymore.
Here’s the full recap of what mattered this week.
## ⚡ Threat of the Week
Citrix
Hackernews
Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks
blogs_hackernews·2026-09-22·CVSS 9.8
CVE-2026-93616 [CRITICAL] Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks
Attackers exploited a previously unknown flaw in Check Point's Security Management Server in a handful of targeted attacks on July 23, the company said .
The flaw, CVE-2026-93616 , allows an attacker who can access the server's web service to run scripts on it without logging in. Check Point released a fix on September 22 for the server that controls firewall policies for the Check Point gateways it manages.
Separately, Check Point said attackers have been trying since September 12 to exploit a VPN flaw it fixed on September 9 . The attempts, agai
https://support.checkpoint.com/results/sk/sk1000171https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-93616
2026-09-22
Published
2026-09-22
Added to CISA KEV
Exploited in the wild