Check Point Patches Actively Exploited Zero-Day Path Traversal in Management Server (CVE-2026-93616)

Key facts

Detection coverage

As of 2026-09-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2617 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CVE-2026-93616 Pre-Auth Path Traversal — Oversized Username LoginRequest to Check Point Management Portal

Detects exploitation attempts against CVE-2026-93616 (CWE-22 path traversal / CWE-434 unrestricted file upload) targeting the Check Point Management web service (TCP/19009) on Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent. Flags oversized (>1000 character) username fields inside LoginRequest entries in cpm.elg — the signature of a traversal payload smuggled through an authentication-adjacent field — optionally correlated with externally-sourced connections to the management port, per Check Point sk1000171.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1595, T1588, T1190
• Data sources: checkpoint_cpm_elg, checkpoint_management_syslog, network_flow_firewall
• Severity: critical
• Confidence: high

Splunk SPL

index=checkpoint sourcetype="checkpoint:cpm:elg" "LoginRequest" "AuthenticationInfoBase{username="
| rex field=_raw "username='(?<login_username>[^']{0,2000})'"
| eval username_len=len(login_username)
| where username_len > 1000
| eval traversal_indicator=if(match(login_username, "\.\./"), "yes", "no")
| stats count as hits, earliest(_time) as first_seen, latest(_time) as last_seen, values(traversal_indicator) as traversal_present by host, src
| append
    [ search index=network sourcetype="checkpoint:connlog" dest_port=19009
      | where NOT (cidrmatch("10.0.0.0/8",src) OR cidrmatch("172.16.0.0/12",src) OR cidrmatch("192.168.0.0/16",src))
      | stats count as network_hits, earliest(_time) as net_first_seen, latest(_time) as net_last_seen by src, dest, dest_port ]
| table host, src, dest, dest_port, hits, network_hits, traversal_present, first_seen, last_seen, net_first_seen, net_last_seen
| sort - hits

Microsoft KQL

Syslog
| where SyslogMessage has "LoginRequest" and SyslogMessage has "AuthenticationInfoBase{username="
| extend LoginUsername = extract(@"username='([^']{0,2000})'", 1, SyslogMessage)
| extend UsernameLength = strlen(LoginUsername)
| where UsernameLength > 1000
| extend TraversalIndicator = iff(LoginUsername has "../", "yes", "no")
| project TimeGenerated, Computer, HostIP, UsernameLength, TraversalIndicator
| union (
    CommonSecurityLog
    | where DestinationPort == 19009
    | where isnotempty(SourceIP) and SourceIP !startswith "10." and SourceIP !startswith "192.168." and SourceIP !startswith "172.16."
    | project TimeGenerated, Computer, SourceIP, DestinationIP, DestinationPort, DeviceAction
)
| sort by TimeGenerated desc

Sigma

title: Check Point Management Server Oversized Username LoginRequest Path Traversal (CVE-2026-93616)
id: 7f3a1c2e-9b4d-4e6a-8f1a-2d5c6e7b9a01
status: experimental
description: Detects an oversized username field (>1000 characters) inside a LoginRequest entry in Check Point Management Portal (cpm) logs, the signature of a CVE-2026-93616 pre-authentication path traversal payload smuggled through an authentication-adjacent field.
references:
    - https://support.checkpoint.com/results/sk/sk1000171
    - https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616
author: Threadlinqs Team
date: 2026-09-22
tags:
    - attack.reconnaissance
    - attack.t1595
    - attack.resource-development
    - attack.t1588
    - attack.initial-access
    - attack.t1190
    - cve.2026.93616
logsource:
    product: checkpoint
    service: cpm
detection:
    selection:
        message|contains: 'LoginRequest'
    auth_field:
        message|contains: 'AuthenticationInfoBase{username='
    condition: selection and auth_field
falsepositives:
    - Legitimate SSO/SAML integrations that pass unusually long assertion strings through the username field (rare; validate length against known IdP payload sizes)
level: critical

Known false positives:

• Legitimate SSO/SAML integrations passing unusually long assertion strings through the username field
• Authorized vulnerability scanners or pentest tooling scoped to test the management interface

Tuning notes: Tune the username-length threshold (default >1000 chars per sk1000171) against environment-normal LoginRequest sizes; allowlist known SSO/IdP integration source IPs; scope to hosts running Security Management Server/MDS/Log Server/SmartEvent roles.

• 🔒 CVE-2026-93616 Pre-Auth Path Traversal — Oversized Username LoginRequest to Check Point Management Portal · unlock with TL Creds
• 🔒 CVE-2026-93616 Post-Traversal Arbitrary Java Class Load — ReflectionUtils Resource Failure + [indicator]/[indicator] Core Dump · unlock with TL Creds
• 🔒 CVE-2026-93616 Post-Compromise Shell Execution or Outbound C2 from Check Point Management Processes · unlock with TL Creds
• 🔒 CVE-2026-93616 Pre-Auth Path Traversal — Oversized Username LoginRequest to Check Point Management Portal · unlock with TL Creds
• 🔒 CVE-2026-93616 Post-Traversal Arbitrary Java Class Load — ReflectionUtils Resource Failure + [indicator]/[indicator] Core Dump · unlock with TL Creds
• 🔒 CVE-2026-93616 Post-Compromise Shell Execution or Outbound C2 from Check Point Management Processes · unlock with TL Creds
• 🔒 CVE-2026-93616 Post-Traversal Arbitrary Java Class Load — ReflectionUtils Resource Failure + [indicator]/[indicator] Core Dump · unlock with TL Creds
• 🔒 CVE-2026-93616 Post-Compromise Shell Execution or Outbound C2 from Check Point Management Processes · unlock with TL Creds

Indicators of compromise

As of 2026-09-27, Threadlinqs Intelligence tracks 15 indicators of compromise for TL-2026-2617.

Technical analysis

Check Point confirmed pinpointed in-the-wild exploitation against a handful of customers beginning 2026-07-23 and shipped an R82.20 Security Hotfix plus Jumbo Hotfix updates for supported branches.

CVE-2026-93616 is a pre-authentication directory traversal and unrestricted file upload vulnerability in the web service that fronts Check Point's central management stack (Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent). An unauthenticated network attacker can supply a crafted path to upload an arbitrary script and, per Check Point's own advisory, cause the server to 'execute a script from an arbitrary path and load an arbitrary Java class' — turning a filesystem-scoping bug into unauthenticated remote code execution on the appliance that holds policy, logs, and administrative control for an organization's entire Check Point estate. Independent analysis (Strix) characterizes the root cause as directory traversal combined with unrestricted file-upload capability, i.e. CWE-22 paired with CWE-434, bypassing the intended access controls on where an uploaded file may land and what it may do once placed. The 'arbitrary Java class' load and the ReflectionUtils artifact in the vendor's own detection guidance indicate the Management Portal (cpm) backend is a Java-based service, consistent with a traversal-then-classload exploitation primitive rather than a native-binary one. Check Point rates the flaw CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and confirmed it 'is exploited in the wild,' with pinpointed attacks against a handful of customers first observed 2026-07-23 — a full two months before the 2026-09-22 public disclosure and R82.20 Security Hotfix release, meeting the definition of a true zero-day. NVD's automated SSVC scoring separately assessed the exploit as 'automatable' with 'total' technical impact, though NVD's exploitation-status field lagged and had not yet reflected Check Point's own confirmed in-the-wild attacks at the time of this record; the vendor's direct statement is treated as authoritative for exploitation status. As of 2026-09-22 the CVE is not yet listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Check Point published CVE-2026-93616 jointly with two companion vulnerabilities disclosed in the same advisory: CVE-2026-85102, an improper-certificate-validation flaw during VPN negotiation on Security Gateway and Spark Firewall (Site-to-Site/Remote Access VPN) that Check Point patched 2026-09-09 and began observing under active exploitation against Spark customers globally from 2026-09-12 using certificates bearing subjects such as CN=vpn,OU=users,O=global, CN=vpn-user,OU=users,O=global, and CN=vpnuser,OU=users,O=global, with attack traffic originating from anonymization infrastructure (VPN services and proxies) and followed by internal port/service scans from suspicious Mobile Access sessions; and CVE-2026-85103, a heap overflow in VPN certificate ASN.1 decoding patched the same day with no confirmed active exploitation. All three carry CVSS 9.8. CVE-2026-93616 is the narrower, longer-running zero-day of the set — a central-management-plane compromise rather than a gateway/VPN compromise — and is the sole CVE in scope for this threat record; the CVE-2026-85102/85103 exploitation details above are recorded for context only and are not folded into this record's MITRE mapping or IOC set.

Check Point's remediation advisory (sk1000171) sets minimum Jumbo Hotfix Take thresholds per branch and ships two Expert-mode grep signatures for retrospective hunting: one flags oversized username fields (>1000 characters) inside LoginRequest entries in cpm.elg, the signature of a traversal payload smuggled through an authentication-adjacent field; the other flags 'Failed to load allResourceFiles map from' errors thrown by upgrade.base.ReflectionUtils in upgrade logs, which occur when a crafted '../'-laden path is fed into the resource-loading routine the exploit abuses, and Check Point explicitly calls out '../' directory-traversal sequences in that log output as a red flag. Check Point notes that failed or partial exploitation attempts have produced FWM/MDS process core dumps under /var/log/dump/usermode/, giving defenders a filesystem artifact to correlate against the log signatures. LivePatch Takes 28/29 do NOT remediate this issue — affected organizations without a qualifying Jumbo Hotfix or the R82.20 Security Hotfix must patch manually. Smart-1 Cloud, Check Point Firewall Appliances (gateway hardware), and Check Point Spark Firewall are explicitly listed by the vendor as unaffected by this particular CVE (Spark is affected by the companion CVE-2026-85102 instead). As an interim compensating control, Check Point recommends restricting TCP/19009 (the management web service port) to trusted administrative IP ranges and configuring SmartConsole Trusted Clients (Manage & Settings > Permissions & Administrators) per the Gateway and Management Hardening Administration Guide. No public proof-of-concept exploit, named threat actor, victim sector, or victim region has been disclosed as of 2026-09-22.

MITRE ATT&CK techniques by tactic:

Execution

T1059 Command and Scripting Interpreter

Defense Evasion

T1070 Indicator Removal; T1562.004 Disable or Modify System Firewall; T1620 Reflective Code Loading

Lateral Movement

T1072 Software Deployment Tools

Persistence

T1098 Account Manipulation; T1136 Create Account; T1505 Server Software Component

Command and Control

T1105 Ingress Tool Transfer

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1565.001 Data Manipulation

Resource Development

T1587 Develop Capabilities; T1588 Obtain Capabilities

Reconnaissance

T1595 Active Scanning

Collection

T1602 Data from Configuration Repository

Remediation

Patches

• R82.20: Security Hotfix (released 2026-09-22, download ID 145601)
• R82.10: Jumbo Hotfix Accumulator Take 45 or higher
• R82: Jumbo Hotfix Accumulator Take 127 or higher
• R81.20: Jumbo Hotfix Accumulator Take 170 or higher
• R81.10 (End of Support): Jumbo Hotfix Accumulator Take 192 or higher

Immediate actions

• Apply the R82.20 Security Hotfix on all Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent instances.
• For R82.10, R82, R81.20, and R81.10 branches without LivePatch, install the minimum required Jumbo Hotfix Take per sk1000171 (R82.10 Take 45+, R82 Take 127+, R81.20 Take 170+, R81.10 Take 192+); note LivePatch Takes 28/29 do NOT remediate this issue.
• Restrict inbound access to TCP/19009 (the management web service) to trusted administrative IP ranges only.
• Run the sk1000171 Expert-mode grep signatures against cpm.elg (oversized username in LoginRequest; '../' traversal sequences in ReflectionUtils 'Failed to load allResourceFiles map from' errors) on every management/log/SmartEvent server to check for prior exploitation.
• Check /var/log/dump/usermode/ for unexpected FWM/MDS core dumps, which Check Point associates with exploitation attempts.

Workarounds

• Restrict TCP/19009 to trusted administrative IPs only.
• Enforce SmartConsole Trusted Clients to limit which hosts can reach the management web service.
• Where feasible, place management servers behind an additional network ACL/firewall layer isolating them from general network access, per Check Point's hardening guidance.

Longer-term hardening

• Configure SmartConsole Trusted Clients (Manage & Settings > Permissions & Administrators) to restrict which hosts may reach management interfaces.
• Apply the Check Point Gateway and Management Hardening Administration Guide baseline to all management-plane infrastructure.
• Upgrade any R80.x or earlier End-of-Support management deployments off unsupported branches; no fix is available for EoS versions.
• Establish a recurring cadence for validating Jumbo Hotfix currency on management infrastructure given the pattern of pre-auth management-plane CVEs in this vendor's product line.

Affected and fixed versions

• Check Point Software Technologies — Security Management Server
  Vulnerable versions: R82.20 (no Security Hotfix); R82.10 Jumbo Hotfix Take ≤44; R82 Jumbo Hotfix Take ≤126; R81.20 Jumbo Hotfix Take ≤166; R81.10 Jumbo Hotfix Take ≤190 (End of Support); R80, R80.10, R80.20, R80.30, R80.40, R81 (all End of Support)
  Fixed in: R82.20 with Security Hotfix; R82.10 Jumbo Hotfix Take 45+; R82 Jumbo Hotfix Take 127+; R81.20 Jumbo Hotfix Take 170+; R81.10 Jumbo Hotfix Take 192+ (End of Support, upgrade recommended)
• Check Point Software Technologies — Multi-Domain Security Management Server
  Vulnerable versions: R82.20 (no Security Hotfix); R82.10 Jumbo Hotfix Take ≤44; R82 Jumbo Hotfix Take ≤126; R81.20 Jumbo Hotfix Take ≤166; R81.10 Jumbo Hotfix Take ≤190 (End of Support); R80 and earlier (End of Support)
  Fixed in: R82.20 with Security Hotfix; R82.10 Jumbo Hotfix Take 45+; R82 Jumbo Hotfix Take 127+; R81.20 Jumbo Hotfix Take 170+; R81.10 Jumbo Hotfix Take 192+ (End of Support, upgrade recommended)
• Check Point Software Technologies — Log Server
  Vulnerable versions: R82.20 (no Security Hotfix); R82.10 Jumbo Hotfix Take ≤44; R82 Jumbo Hotfix Take ≤126; R81.20 Jumbo Hotfix Take ≤166; R81.10 Jumbo Hotfix Take ≤190 (End of Support); R80 and earlier (End of Support)
  Fixed in: R82.20 with Security Hotfix; R82.10 Jumbo Hotfix Take 45+; R82 Jumbo Hotfix Take 127+; R81.20 Jumbo Hotfix Take 170+; R81.10 Jumbo Hotfix Take 192+ (End of Support, upgrade recommended)
• Check Point Software Technologies — Multi-Domain Log Server
  Vulnerable versions: R82.20 (no Security Hotfix); R82.10 Jumbo Hotfix Take ≤44; R82 Jumbo Hotfix Take ≤126; R81.20 Jumbo Hotfix Take ≤166; R81.10 Jumbo Hotfix Take ≤190 (End of Support); R80 and earlier (End of Support)
  Fixed in: R82.20 with Security Hotfix; R82.10 Jumbo Hotfix Take 45+; R82 Jumbo Hotfix Take 127+; R81.20 Jumbo Hotfix Take 170+; R81.10 Jumbo Hotfix Take 192+ (End of Support, upgrade recommended)
• Check Point Software Technologies — SmartEvent
  Vulnerable versions: R82.20 (no Security Hotfix); R82.10 Jumbo Hotfix Take ≤44; R82 Jumbo Hotfix Take ≤126; R81.20 Jumbo Hotfix Take ≤166; R81.10 Jumbo Hotfix Take ≤190 (End of Support); R80 and earlier (End of Support)
  Fixed in: R82.20 with Security Hotfix; R82.10 Jumbo Hotfix Take 45+; R82 Jumbo Hotfix Take 127+; R81.20 Jumbo Hotfix Take 170+; R81.10 Jumbo Hotfix Take 192+ (End of Support, upgrade recommended)

Timeline

Last updated 2026-09-27 · revalidated 1× · latest source

• 2026-07-23 Check Point first observes pinpointed in-the-wild exploitation attempts against CVE-2026-93616, affecting a handful of customers, well before public disclosure.
• 2026-09-09 Check Point discloses and patches companion vulnerability CVE-2026-85103 (heap overflow in VPN certificate ASN.1 decoding) in the same release window; no active exploitation confirmed for this CVE.
• 2026-09-09 Check Point discloses and patches companion vulnerability CVE-2026-85102 (VPN certificate validation pre-auth RCE) on Security Gateway and Spark Firewall via Jumbo Hotfix Accumulator, plus an urgent LivePatch Take 24 for eligible systems.
• 2026-09-12 Check Point observes a wave of active exploitation of CVE-2026-85102 beginning against Spark Firewall customers globally, using anonymization infrastructure including VPN services and proxies, followed by internal port/service scanning from suspicious Mobile Access sessions.
• 2026-09-20 Check Point support article sk1000171 for CVE-2026-93616 is created with IOCs and locked-ioc-2 hunting commands, ahead of the public advisory.
• 2026-09-22 CISA adds CVE-2026-93616 ("Check Point Multiple Products Path Traversal Vulnerability") and companion CVE-2026-85102 to the Known Exploited Vulnerabilities catalog under BOD 26-04.
• 2026-09-22 BleepingComputer and other outlets report on the Check Point Management Server zero-day disclosure and patch.
• 2026-09-22 CVE-2026-93616 is reserved (2026-09-18) and published to NVD/MITRE the same day as vendor disclosure, with the vulnerability not yet added to the CISA KEV catalog as of this date.
• 2026-09-22 Check Point publishes support advisory sk1000171 with per-branch patch levels, hardening guidance, and Expert-mode IOC grep signatures for CVE-2026-93616.
• 2026-09-22 Check Point releases the R82.20 Security Hotfix (download ID 145601) and updated Jumbo Hotfix Take thresholds for R82.10, R82, R81.20, and R81.10 to remediate CVE-2026-93616.
• 2026-09-22 Check Point publishes a joint security advisory disclosing CVE-2026-93616 as a management-server zero-day exploited against a handful of customers, alongside the earlier-patched CVE-2026-85102.
• 2026-09-23 SecurityWeek, SOC Prime, and other outlets publish further analysis and hunting guidance for the management server zero-day.
• 2026-09-25 CISA KEV remediation and forensic-triage deadline for U.S. federal civilian agencies under BOD 26-04.

Update history

• 2026-09-27 — CVE-2026-93616: Check Point Management Server Zero-Day Exploited in Targeted Attacks (Pre-Auth Path Traversal / Arbitrary File Upload to Script Execution): What changed Severity, exploitability, CVSS, and status are unchanged.

Sources cited

• NVD — CVE-2026-93616 Detail NVD (NIST) · Advisory · 2026-09-22
• Security Advisory – Action Required – Active Exploitation of CVE-2026-85102 and a Management Pre-Authentication Vulnerability CVE-2026-93616 Check Point · Vendor report · 2026-09-22
• sk1000171 — CVE-2026-93616 Management Path Traversal remediation and IOC guidance Check Point · Vendor report · 2026-09-22
• sk1000117 — CVE-2026-85102 / CVE-2026-85103 VPN vulnerability remediation guidance Check Point · Vendor report · 2026-09-09
• CVE-2026-93616: Quantum Security Management Path Traversal strix.ai · Research · 2026-09-22
• CVE-2026-93616 - Critical Vulnerability thehackerwire.com · Research · 2026-09-22
• CVE-2026-93616: CWE-22 Path Traversal in checkpoint Quantum Security Management radar.offseq.com · Research · 2026-09-22
• Check Point patches management server zero-day exploited in attacks BleepingComputer · News · 2026-09-22
• Check Point Patches Critical VPN Vulnerabilities SecurityWeek · News · 2026-09-09

More in vulnerability

• CISA adds four KEVs: GPUStack CVE-2026-102895, SignalWire FreeSwitch CVE-2026-116779, OpenBSD OpenSSH CVE-2026-123158, IBM Aspera Faspex CVE-2026-123218
• Able2Shell: 33 N-able N-central Vulnerabilities Chained into RCE and Root Privilege Escalation; N-able Takes Hosted Cloud Offline
• Windows Dangling COM Object Registration Local Privilege Escalation (CVE-2026-66804, incomplete fix for CVE-2026-50343 'Dark Elevator')
• "Office Party" flaw in Anthropic Claude DOCX/PPTX/XLSX skills (soffice.py LD_PRELOAD shim) enables code execution on Linux
• ForgeRock Attack Chain: Default admin:admin Felix Console Credentials and WAF Path-Encoding Bypass Lead to RCE and Remote Vehicle Unlock at Two Automakers

Related coverage of this activity

• Check Point Pre-Auth RCE

Other reports on CVE-2026-93616

• Eclypsium InfraTrust Pulse (Oct 2026): Actively Exploited Flaws Across Network Infrastructure Appliances (NetScaler CVE-2026-88771, Ivanti CVE-2026-104935, Check Point CVE-2026-93616, Cisco, Arista VeloCloud, FortiMail, F5 BIG-IP APM, PAN-OS, PHP2Shell, Linux Copy Fail)
• CISA Adds Four Actively Exploited KEVs: Check Point Gateway/Management RCE Flaws, Arista VeloCloud Orchestrator Auth Bypass, F5 BIG-IP APM Heap Overflow

Previous and next in vulnerability

• BigDiskBuster PoC Blocks Windows Defender Signature/Platform Updates (DoS) Previous report
• BigDiskBuster PoC Blocks Microsoft Defender Antivirus Updates via Disk-Space Exhaustion Next report