Fixing and finding
Jump to remediation plan
CVE ID
CVE-2026-93616
Published 2026-09-22
Updated 14 days ago
Vendor/s
Check Point
Product/s
Multiple Products
Version/s
r80 > r81.10
KEV Status
Active Exploitation
Listed in CISA's Known Exploited Vulnerabilities catalog. Active
exploitation observed in the wild.
CVSS Score (v3.1)
9.8
/ 10
Critical
Severity Details
Base score
9.8 Critical
Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Description
Critical CVSS 9.8 RCE vulnerability in Check Point Management Servers (CVE-2026-93616). Actively exploited; unauthenticated attackers can execute scripts.
CPE
Check Point
| Product | Version Start | Version End (excl.) | Status |
|---|---|---|---|
| multi-domain_security_management | r80 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.10 | r81.10 | vulnerable |
| multi-domain_security_management | r81.20 | r81.20 | vulnerable |
| multi-domain_security_management | r81.20 | r81.20 | vulnerable |
| multi-domain_security_management | r81.20 | r81.20 | vulnerable |
| multi-domain_security_management | r81.20 | r81.20 | vulnerable |
| multi-domain_security_management | r81.20 | r81.20 | vulnerable |
| multi-domain_security_management | r81.20 | r81.20 | vulnerable |
| multi-domain_security_management | r81.20 | r81.20 | vulnerable |
| multi-domain_security_management | r81.20 | r81.20 | vulnerable |
| multi-domain_security_management | r81.20 | r81.20 | vulnerable |
| multi-domain_security_management | r81.20 | r81.20 | vulnerable |
| multi-domain_security_management | r81.20 | r81.20 | vulnerable |
| multi-domain_security_management | r81.20 | r81.20 | vulnerable |
| multi-domain_security_management | r81.20 | r81.20 | vulnerable |
| multi-domain_security_management | r81.20 | r81.20 | vulnerable |
| multi-domain_security_management | r81.20 | r81.20 | vulnerable |
| multi-domain_security_management | r81.20 | r81.20 | vulnerable |
| multi-domain_security_management | r81.20 | r81.20 | vulnerable |
| multi-domain_security_management | r81.20 | r81.20 | vulnerable |
| multi-domain_security_management | r81.20 | r81.20 | vulnerable |
| multi-domain_security_management | r81.20 | r81.20 | vulnerable |
| multi-domain_security_management | r81.20 | r81.20 | vulnerable |
| multi-domain_security_management | r81.20 | r81.20 | vulnerable |
| multi-domain_security_management | r81.20 | r81.20 | vulnerable |
| multi-domain_security_management | r81.20 | r81.20 | vulnerable |
| multi-domain_security_management | r81.20 | r81.20 | vulnerable |
| multi-domain_security_management | r81.20 | r81.20 | vulnerable |
| multi-domain_security_management | r81.20 | r81.20 | vulnerable |
| multi-domain_security_management | r81.20 | r81.20 | vulnerable |
| multi-domain_security_management | r81.20 | r81.20 | vulnerable |
| multi-domain_security_management | r81.20 | r81.20 | vulnerable |
| multi-domain_security_management | r81.20 | r81.20 | vulnerable |
| multi-domain_security_management | r81.20 | r81.20 | vulnerable |
| multi-domain_security_management | r81.20 | r81.20 | vulnerable |
| multi-domain_security_management | r81.20 | r81.20 | vulnerable |
| multi-domain_security_management | r81.20 | r81.20 | vulnerable |
| multi-domain_security_management | r81.20 | r81.20 | vulnerable |
| multi-domain_security_management | r81.20 | r81.20 | vulnerable |
| multi-domain_security_management | r81.20 | r81.20 | vulnerable |
| multi-domain_security_management | r81.20 | r81.20 | vulnerable |
| multi-domain_security_management | r81.20 | r81.20 | vulnerable |
| multi-domain_security_management | r82 | r82 | vulnerable |
| multi-domain_security_management | r82 | r82 | vulnerable |
| multi-domain_security_management | r82 | r82 | vulnerable |
| multi-domain_security_management | r82 | r82 | vulnerable |
| multi-domain_security_management | r82 | r82 | vulnerable |
| multi-domain_security_management | r82 | r82 | vulnerable |
| multi-domain_security_management | r82 | r82 | vulnerable |
| multi-domain_security_management | r82 | r82 | vulnerable |
| multi-domain_security_management | r82 | r82 | vulnerable |
| multi-domain_security_management | r82 | r82 | vulnerable |
| multi-domain_security_management | r82 | r82 | vulnerable |
| multi-domain_security_management | r82 | r82 | vulnerable |
| multi-domain_security_management | r82 | r82 | vulnerable |
| multi-domain_security_management | r82 | r82 | vulnerable |
| multi-domain_security_management | r82 | r82 | vulnerable |
| multi-domain_security_management | r82 | r82 | vulnerable |
| multi-domain_security_management | r82 | r82 | vulnerable |
| multi-domain_security_management | r82 | r82 | vulnerable |
| multi-domain_security_management | r82 | r82 | vulnerable |
| multi-domain_security_management | r82 | r82 | vulnerable |
| multi-domain_security_management | r82 | r82 | vulnerable |
| multi-domain_security_management | r82 | r82 | vulnerable |
| multi-domain_security_management | r82.10 | r82.10 | vulnerable |
| multi-domain_security_management | r82.10 | r82.10 | vulnerable |
| multi-domain_security_management | r82.10 | r82.10 | vulnerable |
| multi-domain_security_management | r82.10 | r82.10 | vulnerable |
| multi-domain_security_management | r82.10 | r82.10 | vulnerable |
| multi-domain_security_management | r82.10 | r82.10 | vulnerable |
| multi-domain_security_management | r82.10 | r82.10 | vulnerable |
| multi-domain_security_management | r82.20 | r82.20 | vulnerable |
| quantum_security_management | r80 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.10 | r81.10 | vulnerable |
| quantum_security_management | r81.20 | r81.20 | vulnerable |
| quantum_security_management | r81.20 | r81.20 | vulnerable |
| quantum_security_management | r81.20 | r81.20 | vulnerable |
| quantum_security_management | r81.20 | r81.20 | vulnerable |
| quantum_security_management | r81.20 | r81.20 | vulnerable |
| quantum_security_management | r81.20 | r81.20 | vulnerable |
| quantum_security_management | r81.20 | r81.20 | vulnerable |
| quantum_security_management | r81.20 | r81.20 | vulnerable |
| quantum_security_management | r81.20 | r81.20 | vulnerable |
| quantum_security_management | r81.20 | r81.20 | vulnerable |
| quantum_security_management | r81.20 | r81.20 | vulnerable |
| quantum_security_management | r81.20 | r81.20 | vulnerable |
| quantum_security_management | r81.20 | r81.20 | vulnerable |
| quantum_security_management | r81.20 | r81.20 | vulnerable |
| quantum_security_management | r81.20 | r81.20 | vulnerable |
| quantum_security_management | r81.20 | r81.20 | vulnerable |
| quantum_security_management | r81.20 | r81.20 | vulnerable |
| quantum_security_management | r81.20 | r81.20 | vulnerable |
| quantum_security_management | r81.20 | r81.20 | vulnerable |
| quantum_security_management | r81.20 | r81.20 | vulnerable |
| quantum_security_management | r81.20 | r81.20 | vulnerable |
| quantum_security_management | r81.20 | r81.20 | vulnerable |
| quantum_security_management | r81.20 | r81.20 | vulnerable |
| quantum_security_management | r81.20 | r81.20 | vulnerable |
| quantum_security_management | r81.20 | r81.20 | vulnerable |
| quantum_security_management | r81.20 | r81.20 | vulnerable |
| quantum_security_management | r81.20 | r81.20 | vulnerable |
| quantum_security_management | r81.20 | r81.20 | vulnerable |
| quantum_security_management | r81.20 | r81.20 | vulnerable |
| quantum_security_management | r81.20 | r81.20 | vulnerable |
| quantum_security_management | r81.20 | r81.20 | vulnerable |
| quantum_security_management | r81.20 | r81.20 | vulnerable |
| quantum_security_management | r81.20 | r81.20 | vulnerable |
| quantum_security_management | r81.20 | r81.20 | vulnerable |
| quantum_security_management | r81.20 | r81.20 | vulnerable |
| quantum_security_management | r81.20 | r81.20 | vulnerable |
| quantum_security_management | r81.20 | r81.20 | vulnerable |
| quantum_security_management | r81.20 | r81.20 | vulnerable |
| quantum_security_management | r81.20 | r81.20 | vulnerable |
| quantum_security_management | r81.20 | r81.20 | vulnerable |
| quantum_security_management | r82 | r82 | vulnerable |
| quantum_security_management | r82 | r82 | vulnerable |
| quantum_security_management | r82 | r82 | vulnerable |
| quantum_security_management | r82 | r82 | vulnerable |
| quantum_security_management | r82 | r82 | vulnerable |
| quantum_security_management | r82 | r82 | vulnerable |
| quantum_security_management | r82 | r82 | vulnerable |
| quantum_security_management | r82 | r82 | vulnerable |
| quantum_security_management | r82 | r82 | vulnerable |
| quantum_security_management | r82 | r82 | vulnerable |
| quantum_security_management | r82 | r82 | vulnerable |
| quantum_security_management | r82 | r82 | vulnerable |
| quantum_security_management | r82 | r82 | vulnerable |
| quantum_security_management | r82 | r82 | vulnerable |
| quantum_security_management | r82 | r82 | vulnerable |
| quantum_security_management | r82 | r82 | vulnerable |
| quantum_security_management | r82 | r82 | vulnerable |
| quantum_security_management | r82 | r82 | vulnerable |
| quantum_security_management | r82 | r82 | vulnerable |
| quantum_security_management | r82 | r82 | vulnerable |
| quantum_security_management | r82 | r82 | vulnerable |
| quantum_security_management | r82 | r82 | vulnerable |
| quantum_security_management | r82.10 | r82.10 | vulnerable |
| quantum_security_management | r82.10 | r82.10 | vulnerable |
| quantum_security_management | r82.10 | r82.10 | vulnerable |
| quantum_security_management | r82.10 | r82.10 | vulnerable |
| quantum_security_management | r82.10 | r82.10 | vulnerable |
| quantum_security_management | r82.10 | r82.10 | vulnerable |
| quantum_security_management | r82.10 | r82.10 | vulnerable |
| quantum_security_management | r82.20 | r82.20 | vulnerable |
Related weakness (CWE)
CWE-22
Remediation plan
1
Apply official patches
Download and install the latest Jumbo Hotfix Accumulator from the Check Point Support Center (sk1000171) specifically designed to address this directory traversal and file upload flaw.
2
Update affected systems
Ensure all Quantum and Multi-Domain Security Management installations running versions R80, R81.10, R81.20, R82, R82.10, or R82.20 are upgraded to the fixed versions specified in the vendor's security advisory.
3
Restrict access
Immediately isolate Management Servers from the public internet and restrict access to the management interface (Gaia Portal and APIs) to a dedicated, firewalled administrative subnet using strict IP allowlists.
4
Monitor for exploitation
Perform a forensic audit of the file system for unexpected scripts in web-accessible directories and review audit logs for unauthorized configuration changes or suspicious administrative logins.
Detection Guidance
"Monitor web server and API logs for HTTP POST requests containing directory traversal sequences, such as '../' or its URL-encoded variants (%2e%2e%2f), especially targeting file upload endpoints. Look for unexpected file creation events in the /web/conf/ or /opt/CPsuite/ directories. Additionally, alert on any unusual outbound network connections from the Management Server or the execution of shell commands by the web server process user."
References
https://support.checkpoint.com/results/sk/sk1000171 Mitigation Patch Vendor Advisory https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/ Vendor Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-93616 US Government Resource
Sources
NIST National Vulnerability Database (NVD)
CISA Known Exploited Vulnerabilities (KEV)