{"id":"CVE-2026-93616","aliases":["EUVD-2026-84375","GHSA-x5gq-4cxx-rf2r"],"status":"published","title":"Directory Traversal and File upload allows execution of arbitrary script on the Management Server","description":"A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.91605,"percentile":0.99816,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-22"],"published":"2026-09-22T12:59:01Z","modified":"2026-09-23T16:38:38Z","kev":{"date_added":"2026-09-22","due_date":"2026-09-25","required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2026-09-22"},{"source":"kev","since":"2026-09-22"}],"exploits":[{"source":"pocgithub","id":"WadesWeaponShed/CVE-2026-93616_Checks","title":"WadesWeaponShed/CVE-2026-93616_Checks","date":"2026-09-22","url":"https://github.com/WadesWeaponShed/CVE-2026-93616_Checks"},{"source":"pocgithub","id":"BishopFox/CVE-2026-93616-check","title":"BishopFox/CVE-2026-93616-check","date":"2026-10-01","url":"https://github.com/BishopFox/CVE-2026-93616-check"},{"source":"nuclei","id":"CVE-2026-93616","title":"Check Point Security Management - Unauthenticated Directory Traversal to RCE","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-93616.yaml"}],"products":[{"vendor":"check point","product":"multiple products"},{"vendor":"checkpoint","product":"multi-domain_security_management"},{"vendor":"checkpoint","product":"quantum security management"},{"vendor":"checkpoint","product":"quantum_security_management"}],"references":[{"url":"https://support.checkpoint.com/results/sk/sk1000171","tags":["Mitigation","Patch","Vendor Advisory"]},{"url":"https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/","tags":["vendor-advisory","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-93616","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93616"},{"url":"https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616"},{"url":"https://github.com/advisories/GHSA-x5gq-4cxx-rf2r"}],"sources":{"cve":[{"id":"CVE-2026-93616","title":"Directory Traversal and File upload allows execution of arbitrary script on the Management Server","description":"A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.","status":"published","published":"2026-09-22T12:59:01.057Z","modified":"2026-09-23T03:55:59.259Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:19:54.122945Z"}],"euvd":[{"id":"EUVD-2026-84375","description":"A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.","status":"published","published":"2026-09-22T12:59:01Z","modified":"2026-09-23T03:55:59Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2026-09-22","updated_at":"2026-11-02T17:28:01.71506Z"}],"ghsa":[{"id":"GHSA-x5gq-4cxx-rf2r","title":"A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload...","description":"A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.","status":"published","published":"2026-09-22T15:32:33Z","modified":"2026-09-22T21:31:15Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:12:18.539197Z"}],"kev":[{"id":"CVE-2026-93616","title":"Check Point Multiple Products Path Traversal Vulnerability","description":"Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts.","cwes":["CWE-22"],"kev":{"date_added":"2026-09-22","due_date":"2026-09-25","required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:15.999436Z"}],"nvd":[{"id":"CVE-2026-93616","description":"A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.","status":"published","published":"2026-09-22T13:17:11.963Z","modified":"2026-09-23T16:38:38.987Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:50.368368Z"}]}}