Check Point Multiple Products Path Traversal Vulnerability
TL;DR 📌
- Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts.
- Highest CVSS: 9.8 (Critical).
- Listed in CISA KEV (2026-09-22) — this is being exploited in the wild.
- Check the advisory for fixed releases — remediation detail is in the vendor link below.
- CVEs: CVE-2026-93616.
What it is
CVE-2026-93616 is a path traversal vulnerability affecting several Check Point management components: Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent. It combines directory traversal with a file upload flaw, allowing an unauthenticated attacker to write arbitrary files outside the intended upload location and then have them executed as scripts.
Because no authentication is required (PR:N, AV:N in the CVSS vector), the attack surface is the management plane exposed over the network. An attacker who can reach the vulnerable service does not need valid credentials or any user interaction to exploit it.
The outcome is arbitrary script execution on the management server itself. Given that these components sit centrally — managing policy, logging, and event correlation across a Check Point deployment — compromise here has implications well beyond the single host. The CVSS score of 9.8 (Critical) reflects full loss of confidentiality, integrity, and availability with no privileges or user interaction needed.
This CVE is listed in CISA’s Known Exploited Vulnerabilities catalogue, added on 22 September 2026, confirming it is known to be exploited.
What to do
- Check the advisory for the current fixed release, since no fixed version is listed in the tracked data at this time. Do not assume patched builds exist yet — verify directly with Check Point’s own advisory.
- Restrict network access to Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent interfaces to trusted management networks only. These should never be exposed to the general internet.
- Given KEV listing, treat this as an active exploitation risk and prioritise mitigation immediately — this is not a theoretical finding.
- Review logs on affected management servers for unexpected file uploads or unfamiliar scripts in web-accessible directories, particularly anything indicating directory traversal attempts in request paths.
- Once Check Point publishes fixed releases, patch as a priority across all affected components — a single management server compromise can affect every enforcement point it manages.
For leadership 🧭
Executive summary. A critical, unauthenticated flaw in Check Point’s central management components lets an attacker plant and run code on the server that controls policy, logging and event correlation for the whole deployment. It is already listed as actively exploited, so this needs urgent attention now, not at the next patch cycle.
Why it matters:
- The flaw sits in the management plane — Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server and SmartEvent — components that oversee policy and logging across an entire Check Point estate.
- No credentials or user interaction are needed (AV:N, PR:N, UI:N), so any attacker who can reach the management interface over the network can attempt exploitation directly.
- Successful exploitation gives arbitrary script execution on the management server, with full loss of confidentiality, integrity and availability (CVSS 9.8).
- It is confirmed in CISA’s Known Exploited Vulnerabilities catalogue, so this is not a theoretical risk sitting on a backlog.
Now / Next / Later:
- Now: Restrict all network access to the affected Security Management, Multi-Domain, Log Server and SmartEvent interfaces to trusted management networks, removing any general internet exposure immediately.
- Next: Check Check Point’s own advisory for a fixed release and schedule patching across every affected component as soon as one is published, since no fixed version is confirmed yet.
- Later: Review logs on management servers for unexpected file uploads, unfamiliar scripts in web-accessible directories, or traversal patterns in request paths, and build this check into ongoing monitoring of the management plane.