CVE-2026-93616: Check Point Multiple Products Path Traversal Vulnerability
Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts.
Overview
Check Point Security Management Server and related products (Multi-Domain Security Management, Log Server, Multi-Domain Log Server, and SmartEvent) contain a path traversal flaw in the management web service that allows a completely unauthenticated attacker to upload and execute arbitrary scripts or Java classes on the server. Affected versions span R80 through R82.20 across multiple release lines. Check Point has confirmed active exploitation against a limited number of customers, and a fix is available now.
Vulnerability details
The management web service, exposed on TCP/19009, accepts file upload or resource-loading requests without requiring authentication. Because the service fails to sanitize attacker-supplied file path parameters, a crafted request containing directory traversal sequences (such as ../../../../) can direct a file write to an arbitrary location on the filesystem outside the intended working directory. Once the file is written, the server's resource-loading mechanism (the ReflectionUtils allResourceFiles loader visible in the advisory logs) processes it, executing the uploaded script or instantiating the supplied Java class.
An attacker with network access to TCP/19009 sends a single unauthenticated HTTP request carrying a traversal-encoded path and a malicious payload. No credentials, prior session, or user interaction are required. Successful exploitation yields remote code execution on the management server with full confidentiality, integrity, and availability impact, effectively giving the attacker control over the security management plane. Check Point's advisory confirms a handful of targeted attacks were observed in the wild as of late September 2026.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Search cpm.elg for oversized username strings using the vendor-provided grep: login attempts with usernames exceeding 1,000 characters are a direct indicator of exploitation attempts; correlate the timestamp with any fwm or mds core dump files in /var/log/dump/usermode/.
- Search cpm.elg for ERROR entries from upgrade.base.ReflectionUtils reporting failure to load allResourceFiles from a path containing traversal sequences (e.g., ../../../../); any such entry indicates an active exploitation attempt against this vulnerability.
Remediation
Additional hardening
- For R82.20, apply the Security Hotfix (TAR) from Check Point. For R82.10, upgrade to Jumbo Hotfix Take 45 or later; for R82, Take 127 or later; for R81.20, Take 170 or later; for R81.10, Take 192 or later. See References for the vendor advisory.
- Restrict access to TCP/19009 to explicitly defined Trusted Client IP addresses via SmartConsole (Manage and Settings, Permissions and Administrators, Trusted Clients). Any source outside that list should be blocked at the perimeter.
- Place the management server behind a Check Point Security Gateway with implied rules active, ensuring no direct internet path to TCP/19009 exists. End-of-support versions (R80.x, R81) should be treated as unpatched and isolated immediately.
- Run the two vendor-provided IoC grep commands against cpm.elg on every Security Management, Multi-Domain, Log, and SmartEvent server to determine whether exploitation has already occurred before applying the patch.
Key dates
References
- https://support.checkpoint.com/results/sk/sk1000171
- https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/
- https://support.checkpoint.com/results/sk/sk1000171/
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-93616
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-93616
Frequently asked questions
Does CVE-2026-93616 affect my FedRAMP authorization?
If Check Point Multiple Products runs inside your authorization boundary, yes. CVE-2026-93616 is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and its remediation deadline of September 25, 2026 has already passed. For a FedRAMP-authorized service, an unpatched KEV in your boundary is an assessor finding. An overdue one is a finding your assessor and sponsoring agency can see right now. Your options are to remediate it or formally document the mitigation and the delay.
How does Knox help me handle CVE-2026-93616?
Knox does not patch your software. Remediating Check Point Multiple Products is your responsibility under the FedRAMP shared-responsibility model. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, plus continuous compliance monitoring and audit-artifact coverage that support documentation of the fix for your next assessment. The remediation work is yours to carry out; maintaining a clean compliance posture while you do it is not something you have to manage on your own.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues, including CVE-2026-93616. Exposure surfaces during ongoing monitoring rather than only when an assessor flags it at review time, giving you the information when it still has remediation value.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2026-93616's remediation deadline of September 25, 2026 has passed. What happens now?
If CVE-2026-93616 remains unremediated, it is already a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult agency conversation. Closing the finding out and documenting why the deadline was missed is what keeps your authorization intact and the agency relationship on solid ground.
Ready to achieve FedRAMP authorization in 90 days or less?
Schedule a meeting to discuss scope, parse readiness, and map your company’s accelerated path to FedRAMP authorization.
_Horizontal_RGB.png)
