# Check Point Patches Actively Exploited Zero-Day Path Traversal in Management Server (CVE-2026-93616)

> Check Point disclosed and same-day patched CVE-2026-93616, a pre-authentication path traversal (CWE-22) and unrestricted file upload (CWE-434) flaw, CVSS 9.8, in the Management web service of Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent that lets an unauthenticated attacker execute a script from an arbitrary path and load an arbitrary Java class. Check Point confirmed pinpointed in-the-wild exploitation against a handful of customers beginning 2026-07-23 and shipped an R82.20 Security Hotfix plus Jumbo Hotfix updates for supported branches.

- **Published:** 2026-09-22T00:00:00Z
- **Last reviewed:** 2026-09-27T02:54:06.361Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2617
- **ID:** TL-2026-2617
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-93616

## Description

CVE-2026-93616 is a pre-authentication directory traversal and unrestricted file upload vulnerability in the web service that fronts Check Point's central management stack (Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent). An unauthenticated network attacker can supply a crafted path to upload an arbitrary script and, per Check Point's own advisory, cause the server to 'execute a script from an arbitrary path and load an arbitrary Java class' — turning a filesystem-scoping bug into unauthenticated remote code execution on the appliance that holds policy, logs, and administrative control for an organization's entire Check Point estate. Independent analysis (Strix) characterizes the root cause as directory traversal combined with unrestricted file-upload capability, i.e. CWE-22 paired with CWE-434, bypassing the intended access controls on where an uploaded file may land and what it may do once placed. The 'arbitrary Java class' load and the ReflectionUtils artifact in the vendor's own detection guidance indicate the Management Portal (cpm) backend is a Java-based service, consistent with a traversal-then-classload exploitation primitive rather than a native-binary one. Check Point rates the flaw CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and confirmed it 'is exploited in the wild,' with pinpointed attacks against a handful of customers first observed 2026-07-23 — a full two months before the 2026-09-22 public disclosure and R82.20 Security Hotfix release, meeting the definition of a true zero-day. NVD's automated SSVC scoring separately assessed the exploit as 'automatable' with 'total' technical impact, though NVD's exploitation-status field lagged and had not yet reflected Check Point's own confirmed in-the-wild attacks at the time of this record; the vendor's direct statement is treated as authoritative for exploitation status. As of 2026-09-22 the CVE is not yet listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Check Point published CVE-2026-93616 jointly with two companion vulnerabilities disclosed in the same advisory: CVE-2026-85102, an improper-certificate-validation flaw during VPN negotiation on Security Gateway and Spark Firewall (Site-to-Site/Remote Access VPN) that Check Point patched 2026-09-09 and began observing under active exploitation against Spark customers globally from 2026-09-12 using certificates bearing subjects such as CN=vpn,OU=users,O=global, CN=vpn-user,OU=users,O=global, and CN=vpnuser,OU=users,O=global, with attack traffic originating from anonymization infrastructure (VPN services and proxies) and followed by internal port/service scans from suspicious Mobile Access sessions; and CVE-2026-85103, a heap overflow in VPN certificate ASN.1 decoding patched the same day with no confirmed active exploitation. All three carry CVSS 9.8. CVE-2026-93616 is the narrower, longer-running zero-day of the set — a central-management-plane compromise rather than a gateway/VPN compromise — and is the sole CVE in scope for this threat record; the CVE-2026-85102/85103 exploitation details above are recorded for context only and are not folded into this record's MITRE mapping or IOC set.

Check Point's remediation advisory (sk1000171) sets minimum Jumbo Hotfix Take thresholds per branch and ships two Expert-mode grep signatures for retrospective hunting: one flags oversized username fields (>1000 characters) inside LoginRequest entries in cpm.elg, the signature of a traversal payload smuggled through an authentication-adjacent field; the other flags 'Failed to load allResourceFiles map from' errors thrown by upgrade.base.ReflectionUtils in upgrade logs, which occur when a crafted '../'-laden path is fed into the resource-loading routine the exploit abuses, and Check Point explicitly calls out '../' directory-traversal sequences in that log output as a red flag. Check Point notes that failed or partial exploitation attempts have produced FWM/MDS process core dumps under /var/log/dump/usermode/, giving defenders a filesystem artifact to correlate against the log signatures. LivePatch Takes 28/29 do NOT remediate this issue — affected organizations without a qualifying Jumbo Hotfix or the R82.20 Security Hotfix must patch manually. Smart-1 Cloud, Check Point Firewall Appliances (gateway hardware), and Check Point Spark Firewall are explicitly listed by the vendor as unaffected by this particular CVE (Spark is affected by the companion CVE-2026-85102 instead). As an interim compensating control, Check Point recommends restricting TCP/19009 (the management web service port) to trusted administrative IP ranges and configuring SmartConsole Trusted Clients (Manage & Settings > Permissions & Administrators) per the Gateway and Management Hardening Administration Guide. No public proof-of-concept exploit, named threat actor, victim sector, or victim region has been disclosed as of 2026-09-22.

## MITRE ATT&CK

- T1595 Active Scanning
- T1588 Obtain Capabilities
- T1587 Develop Capabilities
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1620 Reflective Code Loading
- T1105 Ingress Tool Transfer
- T1136 Create Account
- T1098 Account Manipulation
- T1562.004 Disable or Modify System Firewall
- T1070 Indicator Removal
- T1602 Data from Configuration Repository
- T1565.001 Data Manipulation
- T1072 Software Deployment Tools

## Sources

- [Check Point patches management server zero-day exploited in attacks](https://www.bleepingcomputer.com/news/security/check-point-patches-management-server-zero-day-exploited-in-attacks/)
- [Security Advisory – Action Required – Active Exploitation of CVE-2026-85102 and a Management Pre-Authentication Vulnerability CVE-2026-93616](https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616)
- [sk1000171 — CVE-2026-93616 Management Path Traversal remediation and IOC guidance](https://support.checkpoint.com/results/sk/sk1000171)
- [sk1000117 — CVE-2026-85102 / CVE-2026-85103 VPN vulnerability remediation guidance](https://support.checkpoint.com/results/sk/sk1000117)
- [NVD — CVE-2026-93616 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-93616)
- [CVE-2026-93616: Quantum Security Management Path Traversal](https://www.strix.ai/cve/CVE-2026-93616)
- [Check Point Patches Critical VPN Vulnerabilities](https://www.securityweek.com/check-point-patches-critical-vpn-vulnerabilities/)
- [CVE-2026-93616 - Critical Vulnerability](https://www.thehackerwire.com/vulnerability/CVE-2026-93616/)
- [CVE-2026-93616: CWE-22 Path Traversal in checkpoint Quantum Security Management](https://radar.offseq.com/threat/cve-2026-93616-cwe-22-improper-limitation-of-a-pathname-to-a-restricted-directory-path-traversal-in-4344dfa6a4d98182)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2617