Check Point Multiple Products Path Traversal Vulnerability
CVE-2026-93616: CVSS 9.8 path traversal and file upload in Check Point Management Server enabling unauth RCE. Confirmed exploited; patches available.
- Vendor
- Check Point
- Product
- Security Management Server, Multi-Domain Management Server, Log Server, SmartEvent
- CVSS
- 9.8
- EPSS (exploit probability)
- 91.6%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2026-93616 being exploited?
Yes. CISA added CVE-2026-93616 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild. It is also listed in ENISA's EU Vulnerability Database (EUVD) exploited list.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 91.6% (scored October 25, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ LISTED ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2026-93616 timeline
- Added to CISA KEVsame day as NVD
- Added to EU KEV (ENISA)same day as NVD
- Published to NVD
- First 0dayNews coverage+1d
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (3 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
CVE-2026-93616 is a directory traversal and file upload vulnerability in Check Point’s management product line. An unauthenticated attacker can exploit the path traversal to write arbitrary scripts to the server and then execute them. No credentials are required.
Affected products: Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, SmartEvent. See the Check Point advisory for affected version ranges and hotfix availability.
Severity: CVSS 9.8 (Critical) per NVD.
KEV status: CISA added CVE-2026-93616 to the Known Exploited Vulnerabilities catalog on September 22, 2026. Confirmed targeted exploitation occurred on July 23, 2026 per Check Point’s disclosure. Federal agencies under BOD 26-04 must remediate by September 25, 2026.
Patch: Check Point released emergency hotfixes. See the advisory for instructions by product version.
For full coverage see Check Point Patches Management Server Zero-Day.
Other Check Point CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-85102 Unauthenticated RCE via VPN certificate handling in Check Point productswrite-up | [ CRITICAL ] | 9.8 | 54.1% | |
| CVE-2026-91843 Stack overflow in login handler allows unauthenticated RCE as rootwrite-up | [ CRITICAL ] | 9.8 | 0.5% | — |
| CVE-2026-85103 Unauthenticated RCE via VPN certificate handling in Check Point productswrite-up | [ CRITICAL ] | 9.8 | 4.3% | — |
| CVE-2026-16232 Check Point SmartConsole improper authenticationwrite-up | [ CRITICAL ] | 9.1 | 3.5% | |
| CVE-2026-50751 Check Point Security Gateway Improper Authentication Vulnerabilityransomware use | [ CRITICAL ] | 9.3 | 85.3% | |
| CVE-2024-24919 Check Point Quantum Security Gateways Information Disclosure Vulnerabilityransomware use | [ HIGH ] | 8.6 | 100.0% |
