CVE-2026-93616

Directory Traversal and File upload allows execution of arbitrary script on the Management Server

Published: Sep 22, 2026Updated: Sep 23, 2026 Sources: CVE List NVDCWE-22

9.8CRITICAL

Description

A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.

In plain language

AI Act now

This is an actively exploited flaw that can let an outsider take over a Quantum Security Management server, so affected businesses should act now.

Executive summary

Unauthenticated network-based arbitrary code execution through directory traversal and malicious file upload on the Management Server enables administrative server takeover.

If affected, business impact

Full management-server takeoverSecurity controls alteredNetwork-wide disruptionSensitive configuration exposureMalicious script execution

What to do now

Confirm whether you run Quantum Security Management and whether its Management Server web service is reachable from untrusted networks.
Restrict access to the Management Server web service to approved administrator networks while you assess exposure.
Contact your software vendor for the approved remediation; no fixed version or patch has been published in the available information.
Review server activity from July 23, 2026 onward for unexpected uploaded files or scripts, using the vendor's published indicators of compromise.

May need vendor / contractor work

What is it

A weakness in the management server can let an outsider place a harmful script where the server will run it. It is like someone being able to slip a master key into your building's control room and then operate the whole facility.

Who is affected

This matters to you if you run Quantum Security Management on a Management Server. It is a risk when that server is reachable over the network, because an attacker does not need a login or anyone to click anything.

How urgent is it

Attackers have already exploited this in targeted attacks, including unauthorized script execution on affected management servers. Treat this as an emergency because a successful attack gives the intruder administrative control of the server.

What to do — in detail

Confirm whether a Check Point Management Server is deployed and identify every network path to its web service, including externally reachable and partner-accessible paths. Restrict that service to trusted administrator networks immediately and preserve relevant server, web-service, and authentication logs for investigation.

No vendor fixed version, supported branch guidance, or patch is available in the findings. Obtain the vendor's approved remediation before making version changes; if patching is delayed, keep the web service inaccessible from untrusted networks and investigate for unexpected uploads or script execution. Check Point provided indicators of compromise, so compare available telemetry against those indicators and investigate matches. This CVE is not listed in CISA KEV, so no CISA remediation due date is available.

Technical context

CVE-2026-93616 is rated CVSS 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-22 directory traversal. An unauthenticated remote attacker can bypass path restrictions, upload a malicious file, and execute arbitrary code with administrative rights on a Check Point Management Server. Check Point reported exploitation in a handful of targeted attacks beginning July 23, 2026; no public exploit code is on record. The CVE is not in CISA KEV. No EPSS value or trend was provided.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

CVSS Vector Breakdown

Exploitability

AV:NAttack Vector

Network

AC:LAttack Complexity

Low

PR:NPrivileges Required

None

UI:NUser Interaction

None

Scope

S:UScope

Unchanged

Impact

C:HConfidentiality

High

I:HIntegrity

High

A:HAvailability

High

Open in CVSS calculator →

Weaknesses

CWE-22

Affected Products

checkpoint

commercial·ILaka check point firewall-1, checkpoint firewall

multi-domain security managementOn-prem

Security Products

Quantum Security Management

Security Products

and 1 more affected products View all →

Exploitability

CISA Known Exploited Vulnerability

Added to KEV:Sep 22, 2026

Remediation due:Sep 25, 2026

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Official Patch Available

Workaround Available

Is your org exposed to CVE-2026-93616?Request an assessment to establish which checks are appropriate for your systems. Check my exposure

Attack Graph

Products CVE Techniques Tactics

Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.

MITRE ATT&CK

2 techniques

Collection

Discovery

View detailed technique mapping

References

https://support.checkpoint.com/results/sk/sk1000171

support.checkpoint.com

https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/

blog.checkpoint.com

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-93616

cisa.gov

News mentions

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2026-93616 and every CVE in our database. Create a free account — no credit card required.

Create Free Account

Plain-language analysis

Impact assessment and exploitation scenario in plain English

Attack graph visualization

Interactive attack path and kill chain mapping

Exploit details & PoC links

ExploitDB, Metasploit, GitHub PoCs with direct links

Nuclei scanner templates

Ready-to-use vulnerability scanner templates

Full remediation guide

Patch instructions, workarounds, and compliance impact

Interactive AI chat

Ask questions about this vulnerability in natural language

Related vulnerabilities

Semantically similar CVEs and attack patterns

REST API & MCP access

Integrate vulnerability data into your workflows