CVE-2026-93616: Check Point Management Servers Path Traversal Allows Unauthenticated Arbitrary Script Upload

Background

Check Point’s Security Management Server and Multi-Domain Security Management Server are the central policy management platforms for Check Point firewall and gateway deployments — they compile and push security policy, manage logs, and administer the fleet of gateways in a Check Point environment. Log Server, Multi-Domain Log Server, and SmartEvent extend this with centralized logging and security event correlation and analytics across the deployment.

These management-plane products are, by design, trusted administrative systems that hold policy configuration, administrator credentials, and log data for an organization’s entire firewall estate. Compromise of any one of them represents compromise of the control plane for the security infrastructure itself — a materially different and more severe outcome than compromising a single gateway.

Technical Mechanism

CVE-2026-93616 is a path traversal vulnerability, CWE-22, affecting Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent. CISA’s description states that the flaw “allows an unauthenticated attacker to upload and execute arbitrary scripts.”

Path traversal vulnerabilities in file-upload-capable web interfaces follow a well-understood pattern: an upload or file-handling endpoint accepts a filename or path parameter from the request, and if that parameter is not properly sanitized against directory-traversal sequences (../, URL-encoded equivalents, or absolute paths), an attacker can direct the written file outside the intended upload directory — into a location where the web server or management process will execute it as code, such as a web-accessible script directory or a scheduled/triggered script location.

Attack flow, as supported by the CISA description:

1. An unauthenticated attacker sends a crafted request to an upload-capable endpoint on one of the affected management products
2. A filename or path parameter in that request contains directory-traversal sequences that are not properly neutralized
3. The resulting file write lands outside the intended, sandboxed upload location — into a path from which the server will execute the file’s contents as a script
4. The attacker then triggers execution (directly, via a follow-up request, or because the management process executes dropped scripts automatically), achieving code execution with the privileges of the management service

Check Point’s advisory (sk1000171) is the authoritative source for the specific vulnerable endpoint and file-handling component; this analysis does not speculate on exact endpoint names or parameters beyond the general CWE-22 mechanism confirmed by CISA’s description.

Real-World Exploitation Evidence

CVE-2026-93616 was added to CISA’s KEV catalog on 2026-09-22, confirming active exploitation in the wild under CISA’s KEV listing criteria. The remediation deadline was set at 2026-09-25 — a three-day window reflecting the severity of unauthenticated, pre-auth code execution against a security management platform.

knownRansomwareCampaignUse is listed as “Unknown” in the KEV record. CISA has not confirmed ransomware campaign use of this vulnerability at this time.

No specific threat actor or named campaign has been publicly attributed to the exploitation of CVE-2026-93616 in the information available for this analysis. Given that this affects the management plane of Check Point’s product line — rather than a single gateway — targeted interest from actors seeking broad network visibility or multi-gateway policy manipulation would be a logical concern, but that is a risk-framing statement, not a confirmed attribution, and should not be treated as evidence of any specific actor’s involvement.

Impact Assessment

A CVSS score of 9.8 for an unauthenticated path traversal leading to arbitrary script execution reflects complete compromise of confidentiality, integrity, and availability on the affected management system. Concretely:

• Policy and configuration control — Security Management Server and Multi-Domain Security Management Server compile and distribute firewall policy to every managed gateway; code execution here can allow an attacker to read, modify, or redistribute security policy across the entire managed gateway fleet
• Credential exposure — management servers typically store administrator credentials and API keys used to manage gateways, as well as certificates used for gateway-to-management trust
• Log and event data exposure — Log Server, Multi-Domain Log Server, and SmartEvent hold historical and real-time security event data; compromise exposes an organization’s security visibility and could allow an attacker to tamper with or delete evidence of other intrusion activity
• Multi-gateway blast radius — because a single management server often administers many gateways (sometimes across multiple customer domains in Multi-Domain deployments), compromise is not confined to one network segment

Sector-specific risk: Managed security service providers (MSSPs) and large enterprises using Multi-Domain Security Management to administer gateways across multiple business units or client environments face a multiplied blast radius — a single compromised Multi-Domain server can expose policy and log data across every managed domain.

Affected Versions

The KEV data does not specify exact affected version ranges. Check Point’s advisory sk1000171 is the definitive source:

Organizations should treat any of these products not yet confirmed against the advisory’s fix list as presumptively vulnerable.

Remediation Steps

CISA’s required action is to apply vendor mitigations per Check Point’s instructions, in compliance with BOD 26-04 and Forensics Triage Requirements, or discontinue use of the product if mitigation is unavailable.

1. Inventory every instance of Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent in the environment.
2. Apply the hotfix/patch referenced in Check Point sk1000171 to each affected instance.
3. Restrict network access to management interfaces — these products should never be reachable from the general internet; enforce access only from dedicated management networks or jump hosts:

# Example firewall rule concept restricting management-plane access
# Allow: TCP management ports from admin jump-host range only
# Deny: all other sources

4. Audit upload directories and web-accessible script paths on affected systems for any unexpected files that may have been dropped prior to patching.
5. Perform forensic triage per CISA’s Forensics Triage Requirements guidance on any instance that was internet-reachable and unpatched during the exploitation window.

Detection Guidance

Check Point has not published a specific public signature for this vulnerability in the data available for this analysis; consult sk1000171 and your IDS/IPS vendor’s feed for CVE-2026-93616-specific detection content.

General indicators to review in the interim:

• Web/application server access logs on management interfaces showing path-traversal sequences (../, %2e%2e%2f, double-encoded variants) in upload-related request parameters
• Unexpected script files (.php, .jsp, .sh, or platform-appropriate executable scripts) appearing in web-accessible directories outside normal deployment/update processes
• Unusual process execution originating from the management server’s web service account, particularly shell or interpreter processes spawned by the web server process
• Review file integrity monitoring (if deployed) on management server web roots for unexpected file creation timestamps

Timeline

References

• Check Point sk1000171 — Vendor advisory
• CISA BOD 26-04 — Prioritizing Security Updates Based on Risk
• CISA BOD 26-04 Implementation Guidance — Forensics Triage Requirements
• NVD — CVE-2026-93616