CVE-2026-93616

Directory Traversal and File upload allows execution of arbitrary script on the Management Server

Exploited in the wild. In CISA KEV since 2026‑09‑22. A vendor fix is available.

CVSS 3.19.8Critical EPSS percentile83rd2.4% chance in 30 days CISA KEVListedsince 2026-09-22, due 2026-09-25
No public exploit known FixVendor fixNo build named by the sources

Published 2026-09-22Updated 2026-09-23Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Confirm whether you run Quantum Security Management and whether its Management Server web service is reachable from untrusted networks.
Restrict access to the Management Server web service to approved administrator networks while you assess exposure.
Contact your software vendor for the approved remediation; no fixed version or patch has been published in the available information.
Review server activity from July 23, 2026 onward for unexpected uploaded files or scripts, using the vendor's published indicators of compromise.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.

In plain language

Written by AI from the record

This is an actively exploited flaw that can let an outsider take over a Quantum Security Management server, so affected businesses should act now.

Unauthenticated network-based arbitrary code execution through directory traversal and malicious file upload on the Management Server enables administrative server takeover.

If you're affected

Full management-server takeover
Security controls altered
Network-wide disruption
Sensitive configuration exposure
Malicious script execution

What is it

A weakness in the management server can let an outsider place a harmful script where the server will run it. It is like someone being able to slip a master key into your building's control room and then operate the whole facility.

Who is affected

This matters to you if you run Quantum Security Management on a Management Server. It is a risk when that server is reachable over the network, because an attacker does not need a login or anyone to click anything.

How urgent is it

Attackers have already exploited this in targeted attacks, including unauthorized script execution on affected management servers. Treat this as an emergency because a successful attack gives the intruder administrative control of the server.

What to do — in detail

Confirm whether a Check Point Management Server is deployed and identify every network path to its web service, including externally reachable and partner-accessible paths. Restrict that service to trusted administrator networks immediately and preserve relevant server, web-service, and authentication logs for investigation.

No vendor fixed version, supported branch guidance, or patch is available in the findings. Obtain the vendor's approved remediation before making version changes; if patching is delayed, keep the web service inaccessible from untrusted networks and investigate for unexpected uploads or script execution. Check Point provided indicators of compromise, so compare available telemetry against those indicators and investigate matches. This CVE is not listed in CISA KEV, so no CISA remediation due date is available.

Technical context

CVE-2026-93616 is rated CVSS 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-22 directory traversal. An unauthenticated remote attacker can bypass path restrictions, upload a malicious file, and execute arbitrary code with administrative rights on a Check Point Management Server. Check Point reported exploitation in a handful of targeted attacks beginning July 23, 2026; no public exploit code is on record. The CVE is not in CISA KEV. No EPSS value or trend was provided.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS83rd

CISA KEV

Listed as exploited in the wild since 2026-09-22.

US federal agencies must remediate by 2026-09-25.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

2.4% chance of exploitation activity in the next 30 days, which ranks it in the 83rd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

11 events over 1 day, from the signal feeds we watch.

2026-09-23Patch availableworkaround available, record updated, record updated
2026-09-22Added to CISA KEVpublished, weakness classified, att&ck mapped, record updated, record updated, record updated

Affected products

checkpointcommercial · ILaka check point firewall-1, checkpoint firewall
- multi-domain security managementOn-premSecurity Products
- Quantum Security ManagementSecurity Products

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable