ZeroDayAlert

CVE-2026-93616: Check Point Multiple Products Path Traversal Vulnerability

Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts.

Check Point Multiple Products Added to KEV 2026-09-22 Federal due 2026-09-25 Known ransomware use

Required action — quoted from CISA

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Where this comes from. The identifier, product, dates and required action above are copied verbatim from the CISA Known Exploited Vulnerabilities catalog. The action plan below is written by an AI agent from that record and published automatically. AssurePort has not independently tested this vulnerability and makes no claim about whether any specific system is affected.

Who is affected

This vulnerability affects Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent. An unauthenticated attacker can exploit a path traversal flaw to upload and execute arbitrary scripts, meaning any deployment of these products reachable over the network is at risk. The record does not specify affected version ranges or patch availability dates.

How to check whether this touches you

  • Inventory your Check Point deployments: identify which of the five affected products you run (Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, SmartEvent).
  • Confirm network reachability: test whether each instance accepts unauthenticated connections from outside your organisation or from untrusted network segments.
  • Check the running version: obtain the product version number from the administrative interface or system information; version strings alone are a signal of potential exposure and do not guarantee safety without patch verification.
  • Review your deployment topology: determine whether these servers are internet-facing, DMZ-positioned, or internal-only, as this affects urgency.

What to do

  1. Immediately: consult Check Point's security advisory and vendor instructions for this CVE to confirm patch availability and supported upgrade paths for your versions.
  2. If patching is delayed: isolate or restrict network access to affected instances to trusted internal networks only; disable any unnecessary remote management or API endpoints.
  3. In parallel: enable detailed logging of all authentication attempts and file upload activities on affected servers; configure alerts for failed or suspicious unauthenticated requests.
  4. Within 24 hours: escalate to your security team if any of these products are internet-reachable or handle sensitive security logs; follow your organisation's BOD 26-04 patch prioritisation process.
  5. Plan and execute: schedule patching according to vendor guidance and your change management process; test patches in a non-production environment first.

If you find you were exposed

Log files and audit trails are your primary evidence of exploitation, since this flaw allows unauthenticated script execution—likely predating your discovery by days or weeks. Begin by collecting and reviewing authentication logs, file uploads, and process execution records from the affected servers going back at least 30 days (or to your earliest reliable log retention point). Look for POST or upload requests lacking credentials, unexpected script files in system directories, and execution of suspicious commands; if your log retention is shorter, document that gap in your incident record for your incident response team.

Get these the morning they land.

One email, only when a vulnerability is newly confirmed as exploited — the CISA record plus our action plan. No more than one a day, and nothing on quiet days.

Knowing it exists is not the same as knowing you are exposed.

This page can tell you that CVE-2026-93616 is being exploited. It cannot tell you whether Multiple Products is running somewhere of yours that is reachable. That question is what a scan answers.

Check your own surface →