CVE-2026-93616
Check Point Multiple Products Path Traversal Vulnerability
Exploited in the wild
This vulnerability is on the CISA Known Exploited Vulnerabilities list, added 2026-09-22. Federal due date: 2026-09-25.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Impact
Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Checkpoint | Quantum Security Management | Versions R82 with Jumbo Hotfix Take 126 or below, R81 (EOS), R80.40 (EOS), R82.20 with no Jumbo Hotfix, R80.20 (EOS), R81.10 (EOS) with Jumbo Hotfix Take 190 or below |
| Checkpoint | Multi-Domain Security Management | from r80 before r81.10 Versions r81.10, r81.20, r82, r82.10, r82.20 |
| Checkpoint | Quantum Security Management | from r80 before r81.10 Versions r81.10, r81.20, r82, r82.10, r82.20 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- CISA KEV catalog
- https://support.checkpoint.com/results/sk/sk1000171
- https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-93616