CVE-2026-93616: Check Point Management Server Path Traversal Under Active Exploitation (CISA KEV)

TL;DR

CVE-2026-93616 is a critical, unauthenticated path traversal and file upload flaw in Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent that lets an attacker write and execute arbitrary scripts on the affected host. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-09-22 with a federal remediation deadline of 2026-09-25, and a public proof-of-concept reference is already circulating. If you run any of these products, treat this as an emergency patch event: apply Check Point advisory sk1000171 mitigations today, restrict management-plane exposure, and hunt for unauthorized files and script execution on those servers.

What is this vulnerability?

Field	Detail
CVE	CVE-2026-93616
Vendor / Product	Check Point — Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, SmartEvent
Vulnerability name	Check Point Multiple Products Path Traversal Vulnerability
Weakness	CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal)
CVSS v3.1	9.8 Critical — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (source: cve@checkpoint.com)
CISA KEV	Added 2026-09-22
Federal due date	2026-09-25
Known ransomware use	Unknown
Vendor advisory	Check Point sk1000171

Overview

CVE-2026-93616 is a path traversal vulnerability affecting multiple Check Point products that sit at the center of enterprise security operations: Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent. The flaw allows an unauthenticated remote attacker to upload and execute arbitrary scripts on the affected management infrastructure. It was published on 2026-09-22 and added to CISA's Known Exploited Vulnerabilities catalog the same day, with a federal remediation due date of 2026-09-25 — a three-day window that signals how seriously CISA views the risk.

The CVSS v3.1 score is 9.8 (Critical) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That vector describes a network-reachable, low-complexity attack that requires no privileges and no user interaction, with high impact to confidentiality, integrity, and availability. The weakness is tracked as CWE-22, the classic path traversal condition in which user-supplied pathnames are not properly constrained to a restricted directory.

Defenders should care about this CVE for a structural reason, not just a severity score. Check Point management servers, log servers, and SmartEvent deployments are the control plane for security policy, logging, and event correlation. They are among the most trusted systems in a Check Point estate, and they frequently hold credentials and trust relationships that reach managed gateways and other integrated components. A compromise of the management plane is not a single-host incident; it is a potential integrity failure of the entire security control plane. That is why CISA's required action directs organizations to apply vendor mitigations in accordance with Check Point guidance and to follow BOD 26-04 risk-based prioritization and the associated Forensics Triage Requirements.

Technical details

Root cause. The vulnerability is a path traversal weakness (CWE-22) in a file upload or file-handling component of the affected products. The application fails to properly sanitize user-supplied pathnames, allowing an attacker to escape the intended upload directory and write files to arbitrary locations on the server. Because the upload functionality is reachable without authentication, the attacker does not need valid credentials or an existing session.

Why it is critical. The combination of directory traversal and unrestricted file upload enables the attacker to place executable scripts in locations the web or application server can later execute. In effect, the flaw collapses the separation between a data upload path and a code execution path.

Affected products.

• Check Point Security Management Server
• Check Point Multi-Domain Security Management Server
• Check Point Log Server
• Check Point Multi-Domain Log Server
• Check Point SmartEvent

Affected version ranges. The available source intelligence does not fully enumerate vulnerable version ranges. Defenders should consult Check Point advisory sk1000171 for the definitive list of affected releases and hotfixes before assuming any given deployment is safe.

Attack prerequisites.

• Network reachability to the management, log, or SmartEvent interface.
• No authentication required.
• No user interaction required.
• Low attack complexity.

Trust boundary violated. The boundary between untrusted uploaded content and the server's filesystem and execution context. Once that boundary is crossed, the attacker operates in the server's execution context rather than as a data submitter.

Impact

Successful exploitation gives an unauthenticated attacker the ability to execute arbitrary scripts on Check Point management and logging infrastructure. From there, the realistic abuse scenarios are severe:

• Confidentiality (High). Attackers can read sensitive configuration, administrator credentials, API keys, and log data. Log servers and SmartEvent frequently aggregate network and user telemetry that is valuable for reconnaissance and lateral movement.
• Integrity (High). Attackers can alter security policies, inject or remove log entries, modify scripts or configurations, and create persistence. Tampering with logs and policy undermines the evidentiary and enforcement value of the security platform itself.
• Availability (High). Attackers can disrupt management services, delete data, or render the management plane unusable — a denial-of-service condition against the systems administrators rely on to respond to incidents.

Perimeter and management-plane risk. These systems are high-value control points. Because they often hold trust relationships with managed gateways and other security components, a compromised management server can become a pivot point for broader environment compromise. Downstream abuse scenarios include using the management server to push malicious policy changes to gateways, exfiltrating logs that contain sensitive network or user information, and establishing persistence for further lateral movement.

Business exposure. If the management server is compromised, the integrity of the entire security control plane is in question. That is a governance, compliance, and incident-response problem that extends well beyond the affected host.

Exploitability

• KEV status. CISA added CVE-2026-93616 to the Known Exploited Vulnerabilities catalog on 2026-09-22, indicating the vulnerability is being actively exploited or poses an unacceptable risk. The federal remediation due date is 2026-09-25.
• EPSS. No EPSS score was provided in the available source intelligence; defenders should check the current EPSS value in their own tooling rather than relying on a static figure.
• Public exploit / PoC. A public proof-of-concept reference has appeared on GitHub (WadesWeaponShed/CVE-2026-93616_Checks). The existence of public tooling increases the likelihood that less sophisticated actors will attempt exploitation.
• In-the-wild context. The KEV listing itself is the strongest available signal of exploitation activity. The short remediation window — three days — reinforces that this is not a theoretical risk.
• Ransomware. Known ransomware use is listed as Unknown. Absence of a ransomware attribution is not evidence of absence; treat it as an open question and monitor.

KEV vs CVSS vs EPSS

Signal	What it measures	Action for this CVE
CISA KEV	Confirmed exploitation in the wild (or unacceptable risk)	Treat as emergency. Federal due date 2026-09-25. Patch or mitigate immediately.
CVSS v3.1 (9.8 Critical)	Intrinsic severity of the flaw	Confirms network-reachable, no-auth, high-impact. Prioritize above routine patching.
EPSS	Probability of exploitation in the next 30 days	Not provided in source intel. Check current value; do not use it to deprioritize a KEV-listed CVE.

Exploitation steps (defensive triage)

These steps describe the exploitation chain at a conceptual level to guide detection, containment, and validation. They are not a weaponized payload and should be used only to build hunts and verify controls.

1. Recon. Identify internet-exposed or internally reachable Check Point management, log, and SmartEvent interfaces. Scan for known service banners and management ports, and reconcile against your asset inventory.
2. Exposure check. Confirm the product and version through unauthenticated responses or vendor-specific endpoints, and compare against the affected version list in Check Point advisory sk1000171.
3. Boundary validation. Determine whether the upload or file-handling endpoint is reachable from untrusted networks. If it is, that is an immediate containment priority regardless of patch status.
4. Log hunt. Search web and application logs for path traversal sequences (../, ..\, %2e%2e%2f, and encoded variants) targeting upload or file-handling endpoints, and for unauthenticated POST or PUT requests that resulted in new files.
5. File system hunt. Look for unexpected files in web-accessible or application-served directories, especially files with script extensions such as .jsp, .jspx, .war, .py, .sh, or .php.
6. Process and network hunt. Review EDR and process telemetry for interpreters (python, perl, bash, java) executing scripts from unusual paths, and for outbound connections from the management server to previously unseen external IPs or domains.
7. Patch verify. After applying Check Point advisory sk1000171 mitigations, re-scan the host to confirm the fix is in place, verify no unauthorized files or accounts remain, and rotate credentials that may have been exposed.
8. Contain and escalate. If you find evidence of exploitation, isolate the host, preserve logs and disk images for forensics, and follow your incident response process. Consult CISA's Forensics Triage Requirements for federal-aligned guidance.

Indicators of compromise

• Unexpected files in web-accessible or application-served directories on Check Point management, log, or SmartEvent servers, especially files with script extensions such as .jsp, .jspx, .war, .py, .sh, or .php.
• HTTP or HTTPS requests containing path traversal sequences such as ../, ..\, %2e%2e%2f, or encoded variants targeting upload or file-handling endpoints.
• Unauthenticated POST or PUT requests to management interfaces that result in new files being written outside expected upload directories.
• New or modified processes spawned by the web or application server, particularly interpreters such as python, perl, bash, or java executing scripts from unusual paths.
• Outbound network connections from the management server to previously unseen external IP addresses or domains, which may indicate command-and-control or data exfiltration.
• Changes to Check Point configuration, policy, or log files that were not made through normal administrative workflows, including unexpected administrator accounts or API keys.
• Log entries showing file system writes, permission changes, or service restarts that correlate with suspicious upload requests.
• EDR or file integrity monitoring alerts for new executable or script files in directories that should be static, such as web roots, plugin directories, or temporary upload folders.

Mitigation and workarounds

Primary remediation. Apply the vendor-provided fixes and mitigations described in Check Point advisory sk1000171. Because CISA has added this CVE to the KEV catalog with a due date of 2026-09-25, prioritize patching or mitigating affected management, log, and SmartEvent systems immediately.

If a patch is not yet available for a specific deployment. Follow Check Point's guidance for compensating controls. Practical options include:

• Restrict network access to management interfaces so that only trusted administrative networks can reach them.
• Disable unnecessary upload functionality where the product allows it.
• Enforce strict firewall rules around management, log, and SmartEvent services.
• For cloud-hosted or externally exposed instances, evaluate whether the service can be taken offline or isolated until remediation is complete.

Governance alignment. Review CISA's BOD 26-04 guidance for risk-based prioritization and the associated Forensics Triage Requirements. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Verification and re-scan. After patching, verify that no unauthorized files or accounts remain, rotate credentials that may have been exposed, and review logs for evidence of prior exploitation. Maintain an inventory of all Check Point management and logging assets, including their internet exposure, to ensure complete coverage.

Community reactions

CISA's addition of CVE-2026-93616 to the KEV catalog on 2026-09-22 signals that the vulnerability is being actively exploited or poses an unacceptable risk, and it imposes a short remediation window for federal agencies. Security media and community discussion have focused on the critical severity, the unauthenticated nature of the flaw, and the fact that it affects the management plane rather than edge gateways — which raises the stakes for defenders. A public proof-of-concept reference has appeared on GitHub, increasing the likelihood that less sophisticated actors will attempt exploitation. Check Point published advisory sk1000171 and directed customers to apply mitigations in line with CISA's BOD 26-04. The consensus among defenders is that management servers should never be directly exposed to the internet, and that this event is a reminder to audit exposure of security infrastructure.

FAQ

Is CVE-2026-93616 in the CISA KEV catalog? Yes. CISA added it on 2026-09-22.

What is the federal remediation due date? 2026-09-25. That is a three-day window from the KEV addition date.

Is the vulnerability exploitable over the internet? The CVSS vector is AV:N (network), and the flaw requires no authentication. Whether a specific deployment is internet-facing depends on your architecture. Stakeholders are responsible for evaluating each asset's internet exposure. Management interfaces should not be directly exposed to the internet.

Which products are affected? Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent.

Does exploitation require credentials? No. The vulnerability is unauthenticated — no valid credentials or existing session are required.

What is the severity? CVSS v3.1 score 9.8 (Critical), vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, per cve@checkpoint.com.

Is there a public exploit? A public proof-of-concept reference has appeared on GitHub (WadesWeaponShed/CVE-2026-93616_Checks).

Is ransomware known to use this vulnerability? Known ransomware use is listed as Unknown. Treat that as an open question and monitor.

How do I verify remediation? Apply Check Point advisory sk1000171 mitigations, re-scan the host to confirm the fix, verify no unauthorized files or accounts remain, and rotate credentials that may have been exposed.

Related resources

• Check Point advisory sk1000171: https://support.checkpoint.com/results/sk/sk1000171/
• CISA BOD 26-04 Prioritizing Security Updates Based on Risk: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
• CISA BOD 26-04 Implementation Guidance and Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
• NVD entry for CVE-2026-93616: https://nvd.nist.gov/vuln/detail/CVE-2026-93616
• Public PoC reference on GitHub: https://github.com/WadesWeaponShed/CVE-2026-93616_Checks