CVE-2026-93616

Published Sep 22, 2026

Last updated 24 days ago

Exploit knownCVSS critical 9.8
Network
Zero-day
Supply chain
VPN

Overview

Description
A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.
Source
cve@checkpoint.com
NVD status
Analyzed
Products
multi-domain_security_management, quantum_security_management

Risk scores

CVSS 3.1

Type
Secondary
Base score
9.8
Impact score
5.9
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
CRITICAL

Known exploits

Data from CISA

Vulnerability name
Check Point Multiple Products Path Traversal Vulnerability
Exploit added on
Sep 22, 2026
Exploit action due
Sep 25, 2026
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Weaknesses

cve@checkpoint.com
CWE-22

Social media

Hype score
Not currently trending
  1. CISA KEV, Sept 22: CVE-2026-85102 (Check Point, SSL/TLS bypass, CVSS 9.8), CVE-2026-93616 (Check Point, path traversal, 9.8), CVE-2026-94127 (F5 BIG-IP APM, buffer overflow → RCE, 9.8). All exploited in the wild. Edge devices, again. Patch this week.

    @Frankly_Alen

    11 Oct 2026

    4 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. Check Point Research detectó explotación activa de dos vulnerabilidades con CVSS 9,8 en Security Gateway y Security Management: CVE-2026-85102 y CVE-2026-93616. Según su aviso del 22 de septiembre, ambas tienen corrección. https://t.co/hvRgTPlBoA 🧵

    @incog_news

    10 Oct 2026

    7 Impressions

    1 Retweet

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  3. DFIR Weekly Recap | A brutal week for perimeter appliances, mail servers, and post-compromise frameworks, with CVE-2026-73570, CVE-2026-88771, CVE-2026-88772, CVE-2026-93616, and Chinese 🇨🇳 espionage dominating. - CVE-2026-73570 in Zimbra Collaboration Suite is actively ht

    @DFIR_Radar

    3 Oct 2026

    237 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    2 Replies

    0 Quotes

  4. Check Point management was a zero-day for ~2 months: CVE-2026-93616 — pre-auth root on the Security Management Server. Exploitation from July 23; public fix Sept 22. Bishop Fox’s “One Port to Root” rebuilds the full chain on TCP/19009. Trap: Jumbo takes that fixed the VP

    @_skinnyguinea

    3 Oct 2026

    84 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  5. Antes: "el Management del firewall está interno, nadie lo toca". Después: CVE-2026-93616 — path traversal pre-auth en Check Point Security Management (CVSS 9.8), explotación puntual desde julio, fix 22 sep, CISA KEV la misma semana. En paralelo, CVE-2026-85102 en Gateway re

    @jfernandogg

    30 Sept 2026

    20 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  6. 🔴 Check Point: two critical flaws under active attack CVE-2026-85102 and CVE-2026-93616 both score CVSS 9.8, affecting VPN gateways and security management infrastructure. Both are now i https://t.co/ThAxdMS4vS #CVE #CVE202685102 #CVE202693616 #CheckPoint #VPN #CyberSecurit

    @stem__shop

    29 Sept 2026

    36 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  7. https://t.co/n7TVLCWwVt Check Point has confirmed active exploitation of CVE-2026-85102 and CVE-2026-93616 in its Security Gateway and Security Management products. CISA added both to its KEV catalogue on 22 September. A Dutch NCSC alert on 10 September warned that large-scale

    @Read0nlyNet

    27 Sept 2026

    45 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  8. Vulnerability · Exploited in the wild CVE-2026-93616 (Check Point · Security Management Server) A pre-authentication path‑traversal in Check Point Management/Log servers (CVE-2026-93616) lets unauthenticated attackers upload and… Full report and PDF: https://t.co/FKJR0eGz

    @gettransilience

    26 Sept 2026

    36 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    1 Reply

    0 Quotes

  9. CISA added two exploited Check Point flaws to KEV: CVE-2026-85102 (VPN gateway RCE) and CVE-2026-93616 (management server script execution). Patch exposed appliances now. Details: https://t.co/Jq3Nv844qY Intel: https://t.co/QC14eBVf0C #2workly

    @2Workly

    25 Sept 2026

    2 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  10. Urgent alert: Two Check Point vulnerabilities — CVE-2026-85102 (VPN certificate validation) and CVE-2026-93616 (path traversal in management tools) — are now being exploited in the wild. Affects Security Gateway, Spark Firewall, SmartEvent and related products. CISA adds them

    @dailytechonx

    25 Sept 2026

    51 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  11. 【CISA KEV速報】2026-09-22付けで4件追加 ・CVE-2026-85102 Check Point Multiple Products ・CVE-2026-93952 Arista VeloCloud Orchestrator ・CVE-2026-93616 Check Point Multiple Products ほか1件 いずれも悪用確認済み。概要と対応期限はこちら https:/

    @sec_news_com

    25 Sept 2026

    44 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  12. Check Point CVE-2026-85102 (Gateway RCE) & CVE-2026-93616 (Mgmt traversal) are in CISA KEV under active exploitation. Note: Gateway patches do not remediate the management plane. Details: https://t.co/bwwsAQAMRh Intel: https://t.co/QC14eBVf0C #2workly

    @2Workly

    24 Sept 2026

    1 Impression

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  13. 🚨 Cybersecurity alert: Active exploitation of two critical Check Point vulnerabilities was reported (CVE-2026-85102, CVE-2026-93616). CVSS 9.8 — fixes are available.Admins: check affected versions & apply updates. Beginners: tell your IT/security team. ✅ https://t.co/n

    @BismarkDz

    24 Sept 2026

    70 Impressions

    3 Retweets

    3 Likes

    0 Bookmarks

    2 Replies

    0 Quotes

  14. Check Point: 2 CVSS 9.8 pre-auth RCEs. 0 credentials needed. Patch by Sept 25. CVE-2026-85102: VPN cert RCE CVE-2026-93616: Path traversal RCE https://t.co/BheQ5yUeGl #CheckPoint #ZeroDay https://t.co/hu5I241iZs

    @DecryptionDigst

    24 Sept 2026

    52 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    1 Reply

    0 Quotes

  15. Check Point VPN gateways are being hit in the wild. CVE-2026-85102 is pre-auth RCE in certificate handling. Spark attacks started 12 Sep. Second management bug CVE-2026-93616 is also on CISA KEV. Federal due date: 25 Sep. Patch now #CyberSecurity #CVE Link https://t.co/9pTXubDMMx

    @Orion84x

    24 Sept 2026

    47 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    2 Replies

    0 Quotes

  16. Active attacks target Check Point VPN flaw CVE-2026-85102 (unauthenticated RCE) and management flaw CVE-2026-93616. Patch Security Gateways now and check logs. #CyberSecurity #CheckPoint #ThreatIntel https://t.co/AObKLxYENy

    @CyberWorldOps

    24 Sept 2026

    53 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  17. The policy brain got path-traversed first. Check Point says attackers hit Security Management Server on July 23 via CVE-2026-93616 (CVSS 9.8): web service path traversal → unauth script upload/run on the box that pushes firewall policy. That is the incentive gradient — own t

    @JedisecX

    24 Sept 2026

    62 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  18. CISA KEV (added Sep 22, due Fri Sep 25): Check Point CVE-2026-85102 + CVE-2026-93616, F5 BIG-IP APM CVE-2026-94127, Arista VeloCloud Orchestrator CVE-2026-93952 (CVSS 10). Vendors: active exploitation. Patch edge/VPN gear before Friday. We help restaurants harden + cyber audits.

    @dariofernandez

    23 Sept 2026

    52 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  19. CISA (22 Sep): Check Point into KEV - CVE-2026-85102 + CVE-2026-93616. VPN cert RCE; pre-auth management path traversal. Both CVSS 9.8. Active. Fed due 25 Sep. Edge and management plane on both. Active exploitation attempts against CP Spark.

    @navydoc001

    23 Sept 2026

    87 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    2 Replies

    0 Quotes

  20. 🚨 ALERT — ACTIVELY EXPLOITED CHECK POINT FLAWS DATE: September 22, 2026 CONFIRMED BY: Check Point Research / CISA PRODUCT: Check Point Security Management / Security Gateway / Spark Firewall CVEs: CVE-2026-93616, CVE-2026-85102 IMPACT: CVE-2026-93616 is a pre-authenticat

    @Python_s_

    23 Sept 2026

    66 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  21. Check Point: active exploitation of Management pre-auth path traversal (CVE-2026-93616) and Spark/gateway cert RCE path (CVE-2026-85102). Handful of Mgmt hits confirmed; Spark probes global. Emergency fixes live; CISA KEV due Sep 25. Restrict Mgmt to trusted IPs.

    @richtechguy

    23 Sept 2026

    44 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  22. 🐦 🚨 Active exploitation alert: F5 BIG-IP APM RCE (CVE-2026-94127, CVSS 9.8) and Check Point mgmt-server path traversal (CVE-2026-93616) exploited in the wild — patch now. Also on CISA KEV: Arista VeloCloud Orchestrator (CVSS 10.0). #infosec #CVE #0day

    @ita_ipo

    23 Sept 2026

    80 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  23. Patch Now | September 23, 2026 Bringing these vulnerabilities to your attention: - Zyxel GS1900 switches (CVE-2026-7273) - Check Point Security Management (CVE-2026-93616, CVSS 9.8) - Veeam Agent for Windows (CVE-2026-32996) https://t.co/fR71dyoG2H | #CyberSafeUG #CERTUGCC htt

    @CERT_UG

    23 Sept 2026

    72 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  24. Le plan de management, c’est souvent le maillon qu’on oublie. Check Point: faille pré-auth sur Security Management (CVE-2026-93616), exploitation limitée, patch dispo. Aussi exploitation active côté VPN gateway (CVE-2026-85102). À patcher vite. https://t.co/01rHqrdUHC

    @kamel_laimene

    23 Sept 2026

    31 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  25. F5 BIG-IP APM, Check Point Security Gateway und VeloCloud Orchestrator stehen wegen aktiv ausgenutzter Sicherheitslücken im Fokus. Ein Überblick über CVE-2026-94127, CVE-2026-85102, CVE-2026-93616 und CVE-2026-93952. https://t.co/UIVtmEjfy1

    @oliverjessner

    23 Sept 2026

    43 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  26. Urgent if you run Check Point Security Management or Spark: CVE-2026-93616 is now confirmed exploited in the wild. A path-traversal flaw in the Management web service enables unauthenticated script execution without login. Many versions are affected and LivePatch Takes 28/29 do h

    @dailytechonx

    23 Sept 2026

    31 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  27. #Check Point released Security Advisory on active exploitation of #CVE-2026-85102 and a Management Pre-Authentication #Zero-day Vulnerability #CVE-2026-93616. Apply updates to remain safe. https://t.co/m4D30qLdLZ

    @NCIIPC

    23 Sept 2026

    360 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  28. 👉 Check Point'te CVSS 9.8'lik iki kritik açık için yama var ama tehdit sürüyor. VPN sertifika açığında (CVE-2026-85102) saldırılar hâlâ devam ediyor. Yönetim sunucusu zero-day'inde (CVE-2026-93616) LivePatch yetmiyor, ayrı hotfix şart. #CheckPoint #ZeroDay #

    @trsiberyazilim

    23 Sept 2026

    108 Impressions

    1 Retweet

    23 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  29. Check Point warns of active zero-day exploitation in Security Management Servers (CVE-2026-93616) & gateways (CVE-2026-85102). Hunt for rogue cert subjects CN=vpn / CN=vpn-user. Details: https://t.co/q6Lxi6sc56 https://t.co/QC14eBVf0C #2workly

    @2Workly

    23 Sept 2026

    0 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  30. Critical zero-days in Cisco ISE (CVE-2026-76460) & Check Point Management (CVE-2026-93616) allow unauth access & RCE. Immediate patching is vital to safeguard data privacy/integrity in transit. #Cybersecurity #ZeroDay #News

    @YourAnon_irc

    23 Sept 2026

    57 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  31. Check Point: since Sep 12 attackers have been sending Spark firewalls a VPN certificate with subject CN=vpn. Unpatched gateways run their code (CVE-2026-85102, CVSS 9.8, fix out Sep 9). Plus a mgmt server zero-day, CVE-2026-93616, exploited since July. KEV due Sep 25. #MSP https:

    @vkhoetsyan

    23 Sept 2026

    88 Impressions

    0 Retweets

    2 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  32. 🚨 Actively Exploited CVE-2026-93616 in Check Point Security Management Server Allows Unauthenticated Script Execution Critical Vulnerability Alert! Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server and

    @zoomeyebot

    23 Sept 2026

    47 Impressions

    0 Retweets

    0 Likes

    1 Bookmark

    0 Replies

    0 Quotes

  33. 米国サイバーセキュリティ・社会基盤安全保障庁(CISA)が既知の悪用された脆弱性カタログに4件の脆弱性を追加。Check Point複数製品のCVE-2026-85102+CVE-2026-93616、Arista VeloCloud OrchestratorのCVE-2026-93952、F5 BIG-IP APMのCVE-20

    @__kokumoto

    23 Sept 2026

    798 Impressions

    0 Retweets

    2 Likes

    2 Bookmarks

    1 Reply

    0 Quotes

  34. Check Point confirms active exploitation of CVE-2026-85102: a CVSS 9.8 pre-auth RCE in VPN certificate validation. Patch shipped Sep 9, attacks began Sep 12. A second flaw, CVE-2026-93616, hits Security Management. Three days from fix to attack. https://t.co/hDp57SUr5k https://t.

    @aratech_social

    23 Sept 2026

    45 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  35. Check Point reports active exploitation of CVE-2026-85102, a pre-auth RCE in Security Gateway VPN certificate handling, and limited exploitation of zero-day CVE-2026-93616 in Management. Fixes are available; customers should patch now. https://t.co/M16SuBdQQs #CyberSecurity

    @xboxnaman

    23 Sept 2026

    15 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  36. Check Point $CHKP reports exploitation of CVE-2026-85102 and CVE-2026-93616. Canada's Cyber Centre says CISA added both to its exploited-vulnerabilities catalog on September 22. AI-generated illustrative visuals. https://t.co/LO6Hkpr7yu

    @ShortInfoNews

    23 Sept 2026

    46 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  37. 🔒 #CyberSecurity CVE-2026-93616: Check Point Management Server Path Traversal Actively Exploited… "On September 22, 2026, CISA added CVE-2026-93616 to the Known Exploited…" 🔗 https://t.co/kM8zGwUswg #CyberSecurity #ThreatIntel #cve202693616 #critical #cisakev

    @SecurityAr58409

    23 Sept 2026

    40 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  38. استغلال نشط لثغرتين يتطلب مراجعة أمنية فورية. التحذير الأمني يشير إلى CVE-2026-85102 وثغرة Management Pre-Authentication برقم CVE-2026-93616، ما يعني أن الخطر لا يقتصر على وجود الث

    @fad_777

    22 Sept 2026

    50 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  39. Check Point mgmt servers hit by unauth script-exec flaw. CVE-2026-93616 CVSS 9.8; hotfix out. Check Point + BleepingComputer. Verify independently. #CyberSecurity #InfoSec #ZeroDay #CVE #ThreatIntel

    @ThreatAlis

    22 Sept 2026

    1 Impression

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  40. 🚨 #SECURITY_ALERT — ZERO-DAY CONFIRMED BY: Check Point Research PRODUCT: Check Point Security Management Server / Multi-Domain Management / Log Server / SmartEvent CVE: CVE-2026-93616 CVSS: 9.8 IMPACT: A pre-authentication path traversal and file-upload flaw can allow an

    @Python_s_

    22 Sept 2026

    80 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Configurations