CVE-2026-93616 · Critical · CISA KEV

Check Point Path Traversal: Unauthenticated RCE in Management Servers (KEV)

Threat Engine Auto-Feed · data current as of 2026-09-23

A path traversal vulnerability in Check Point Security Management, Multi-Domain Security Management, Log Server, Multi-Domain Log Server, and SmartEvent allows an unauthenticated attacker to upload and execute arbitrary scripts. This vulnerability is actively exploited in the wild, as confirmed by its inclusion in the CISA KEV catalog, and has an EPSS score in the 83rd percentile.

  • CVSS:
  • EPSS percentile: 0.8348
  • Exploitation pressure: 75/100 (Critical)

Exploitation reality: listed in CISA KEV (exploited in the wild) · EPSS 83th percentile. Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

Path traversal occurs when an application allows user-supplied input to construct file paths without proper validation. This enables an attacker to access or manipulate files outside of the intended directory, potentially leading to unauthorized file uploads, execution, or information disclosure.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Organizations utilizing Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, or SmartEvent.
  • Financial services organizations (due to assessed targeting by FIN7, LockBit affiliates, APT38).
  • Technology sector organizations (due to assessed targeting by APT29, Scattered Spider).

Misconfigurations that escalate it

  • Lack of robust input validation on file upload functionalities.
  • Insufficient access controls on server directories.

High-impact scenarios

  • Unauthenticated remote code execution (RCE) on critical security infrastructure.
  • Complete compromise of Check Point management servers.
  • Potential for lateral movement into the broader network.
  • Disruption of security operations and logging capabilities.

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor Check Point management server logs for unusual file uploads or script executions.
  • Look for unauthorized file creation or modification in critical directories.
  • Implement network intrusion detection systems (NIDS) to flag suspicious traffic patterns targeting Check Point management interfaces.

Contain

  • Isolate affected Check Point management servers from the network if compromise is suspected.
  • Review and restrict network access to Check Point management interfaces to only necessary administrative hosts.

Patch

  • Apply vendor-provided security patches for Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent immediately.

Frontier verdict — Critical

Critical priority due to active exploitation (CISA KEV), unauthenticated RCE, and high EPSS percentile, impacting core security infrastructure.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.