Directory Traversal and File Upload Vulnerability in Check Point Management Server
CVE-2026-93616

9.8CRITICAL

Key Information:

Vendor: Checkpoint
Status: Quantum Security Management
Vendor: CVE Published:; 22 September 2026

Badges

📈 Score: 118👾 Exploit Exists🟣 EPSS 19%🦅 CISA Reported📰 News Worthy

What is CVE-2026-93616?

CVE-2026-93616 is a critical vulnerability affecting the Check Point Management Server, a central component in Check Point's suite of cybersecurity products designed to manage and secure network infrastructure. This vulnerability is characterized as a directory traversal and file upload flaw, enabling unauthenticated attackers to access sensitive directories and upload arbitrary scripts to the server. Such capabilities can have dire consequences for organizations relying on the Check Point Management Server, as attackers could execute malicious scripts, potentially gaining control over the server and compromising the integrity and confidentiality of sensitive data.

Potential impact of CVE-2026-93616

Unauthorized Script Execution: The ability for attackers to upload and execute arbitrary scripts on the Check Point Management Server could lead to complete system compromise. This can allow an adversary to manipulate or extract confidential information, disrupt services, or perform further attacks within the organization's network.
Data Breaches: Exploitation of this vulnerability could facilitate unauthorized access to sensitive data stored on or managed by the server. This could result in significant data breaches, exposing personal, financial, or proprietary information, and leading to legal ramifications and reputational damage for the affected organization.
Increased Attack Surface: The vulnerability not only endangers the integrity of the Check Point Management Server but may also serve as a launchpad for subsequent attacks targeting interconnected systems and devices. This broadens the attack surface and increases the risk of a wider network compromise, potentially affecting multiple layers of an organization's cybersecurity architecture.

CISA has reported CVE-2026-93616

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2026-93616 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.