Fixing and finding [Jump to remediation plan](#remediation) CVE ID # CVE-2026-93616 Published 2026-09-22 Updated last month Vendor/s Check Point Product/s Multiple Products Version/s r80 > r81.10 KEV Status Active Exploitation Listed in CISA's Known Exploited Vulnerabilities catalog. Active exploitation observed in the wild. CVSS Score (v3.1) 9.8 / 10 Critical Severity Details Base score 9.8 Critical Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged Confidentiality High Integrity High Availability High Table of Contents [Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources) [Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources) ## Description Critical CVSS 9.8 RCE vulnerability in Check Point Management Servers (CVE-2026-93616). Actively exploited; unauthenticated attackers can execute scripts. ## Why this matters "CVE-2026-93616 is a critical vulnerability with a CVSS score of 9.8, affecting Check Point Quantum and Multi-Domain Security Management servers. This flaw allows unauthenticated attackers to perform directory traversal and upload malicious files, leading to remote code execution (RCE) on the management infrastructure. Its inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog signifies that threat actors are actively leveraging this weakness in the wild. Given that management servers often hold the keys to an entire network's security policy, a compromise here could lead to total domain takeover, data exfiltration, and persistent access within highly sensitive environments." ## CPE Check Point | Product | Version Start | Version End (excl.) | Status | | ---------------------------------- | ------------- | ------------------- | ---------- | | multi-domain\_security\_management | r80 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.10 | r81.10 | vulnerable | | multi-domain\_security\_management | r81.20 | r81.20 | vulnerable | | multi-domain\_security\_management | r81.20 | r81.20 | vulnerable | | multi-domain\_security\_management | r81.20 | r81.20 | vulnerable | | multi-domain\_security\_management | r81.20 | r81.20 | vulnerable | | multi-domain\_security\_management | r81.20 | r81.20 | vulnerable | | multi-domain\_security\_management | r81.20 | r81.20 | vulnerable | | multi-domain\_security\_management | r81.20 | r81.20 | vulnerable | | multi-domain\_security\_management | r81.20 | r81.20 | vulnerable | | multi-domain\_security\_management | r81.20 | r81.20 | vulnerable | | multi-domain\_security\_management | r81.20 | r81.20 | vulnerable | | multi-domain\_security\_management | r81.20 | r81.20 | vulnerable | | multi-domain\_security\_management | r81.20 | r81.20 | vulnerable | | multi-domain\_security\_management | r81.20 | r81.20 | vulnerable | | multi-domain\_security\_management | r81.20 | r81.20 | vulnerable | | multi-domain\_security\_management | r81.20 | r81.20 | vulnerable | | multi-domain\_security\_management | r81.20 | r81.20 | vulnerable | | multi-domain\_security\_management | r81.20 | r81.20 | vulnerable | | multi-domain\_security\_management | r81.20 | r81.20 | vulnerable | | multi-domain\_security\_management | r81.20 | r81.20 | vulnerable | | multi-domain\_security\_management | r81.20 | r81.20 | vulnerable | | multi-domain\_security\_management | r81.20 | r81.20 | vulnerable | | multi-domain\_security\_management | r81.20 | r81.20 | vulnerable | | multi-domain\_security\_management | r81.20 | r81.20 | vulnerable | | multi-domain\_security\_management | r81.20 | r81.20 | vulnerable | | multi-domain\_security\_management | r81.20 | r81.20 | vulnerable | | multi-domain\_security\_management | r81.20 | r81.20 | vulnerable | | multi-domain\_security\_management | r81.20 | r81.20 | vulnerable | | multi-domain\_security\_management | r81.20 | r81.20 | vulnerable | | multi-domain\_security\_management | r81.20 | r81.20 | vulnerable | | multi-domain\_security\_management | r81.20 | r81.20 | vulnerable | | multi-domain\_security\_management | r81.20 | r81.20 | vulnerable | | multi-domain\_security\_management | r81.20 | r81.20 | vulnerable | | multi-domain\_security\_management | r81.20 | r81.20 | vulnerable | | multi-domain\_security\_management | r81.20 | r81.20 | vulnerable | | multi-domain\_security\_management | r81.20 | r81.20 | vulnerable | | multi-domain\_security\_management | r81.20 | r81.20 | vulnerable | | multi-domain\_security\_management | r81.20 | r81.20 | vulnerable | | multi-domain\_security\_management | r81.20 | r81.20 | vulnerable | | multi-domain\_security\_management | r81.20 | r81.20 | vulnerable | | multi-domain\_security\_management | r81.20 | r81.20 | vulnerable | | multi-domain\_security\_management | r82 | r82 | vulnerable | | multi-domain\_security\_management | r82 | r82 | vulnerable | | multi-domain\_security\_management | r82 | r82 | vulnerable | | multi-domain\_security\_management | r82 | r82 | vulnerable | | multi-domain\_security\_management | r82 | r82 | vulnerable | | multi-domain\_security\_management | r82 | r82 | vulnerable | | multi-domain\_security\_management | r82 | r82 | vulnerable | | multi-domain\_security\_management | r82 | r82 | vulnerable | | multi-domain\_security\_management | r82 | r82 | vulnerable | | multi-domain\_security\_management | r82 | r82 | vulnerable | | multi-domain\_security\_management | r82 | r82 | vulnerable | | multi-domain\_security\_management | r82 | r82 | vulnerable | | multi-domain\_security\_management | r82 | r82 | vulnerable | | multi-domain\_security\_management | r82 | r82 | vulnerable | | multi-domain\_security\_management | r82 | r82 | vulnerable | | multi-domain\_security\_management | r82 | r82 | vulnerable | | multi-domain\_security\_management | r82 | r82 | vulnerable | | multi-domain\_security\_management | r82 | r82 | vulnerable | | multi-domain\_security\_management | r82 | r82 | vulnerable | | multi-domain\_security\_management | r82 | r82 | vulnerable | | multi-domain\_security\_management | r82 | r82 | vulnerable | | multi-domain\_security\_management | r82 | r82 | vulnerable | | multi-domain\_security\_management | r82.10 | r82.10 | vulnerable | | multi-domain\_security\_management | r82.10 | r82.10 | vulnerable | | multi-domain\_security\_management | r82.10 | r82.10 | vulnerable | | multi-domain\_security\_management | r82.10 | r82.10 | vulnerable | | multi-domain\_security\_management | r82.10 | r82.10 | vulnerable | | multi-domain\_security\_management | r82.10 | r82.10 | vulnerable | | multi-domain\_security\_management | r82.10 | r82.10 | vulnerable | | multi-domain\_security\_management | r82.20 | r82.20 | vulnerable | | quantum\_security\_management | r80 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.10 | r81.10 | vulnerable | | quantum\_security\_management | r81.20 | r81.20 | vulnerable | | quantum\_security\_management | r81.20 | r81.20 | vulnerable | | quantum\_security\_management | r81.20 | r81.20 | vulnerable | | quantum\_security\_management | r81.20 | r81.20 | vulnerable | | quantum\_security\_management | r81.20 | r81.20 | vulnerable | | quantum\_security\_management | r81.20 | r81.20 | vulnerable | | quantum\_security\_management | r81.20 | r81.20 | vulnerable | | quantum\_security\_management | r81.20 | r81.20 | vulnerable | | quantum\_security\_management | r81.20 | r81.20 | vulnerable | | quantum\_security\_management | r81.20 | r81.20 | vulnerable | | quantum\_security\_management | r81.20 | r81.20 | vulnerable | | quantum\_security\_management | r81.20 | r81.20 | vulnerable | | quantum\_security\_management | r81.20 | r81.20 | vulnerable | | quantum\_security\_management | r81.20 | r81.20 | vulnerable | | quantum\_security\_management | r81.20 | r81.20 | vulnerable | | quantum\_security\_management | r81.20 | r81.20 | vulnerable | | quantum\_security\_management | r81.20 | r81.20 | vulnerable | | quantum\_security\_management | r81.20 | r81.20 | vulnerable | | quantum\_security\_management | r81.20 | r81.20 | vulnerable | | quantum\_security\_management | r81.20 | r81.20 | vulnerable | | quantum\_security\_management | r81.20 | r81.20 | vulnerable | | quantum\_security\_management | r81.20 | r81.20 | vulnerable | | quantum\_security\_management | r81.20 | r81.20 | vulnerable | | quantum\_security\_management | r81.20 | r81.20 | vulnerable | | quantum\_security\_management | r81.20 | r81.20 | vulnerable | | quantum\_security\_management | r81.20 | r81.20 | vulnerable | | quantum\_security\_management | r81.20 | r81.20 | vulnerable | | quantum\_security\_management | r81.20 | r81.20 | vulnerable | | quantum\_security\_management | r81.20 | r81.20 | vulnerable | | quantum\_security\_management | r81.20 | r81.20 | vulnerable | | quantum\_security\_management | r81.20 | r81.20 | vulnerable | | quantum\_security\_management | r81.20 | r81.20 | vulnerable | | quantum\_security\_management | r81.20 | r81.20 | vulnerable | | quantum\_security\_management | r81.20 | r81.20 | vulnerable | | quantum\_security\_management | r81.20 | r81.20 | vulnerable | | quantum\_security\_management | r81.20 | r81.20 | vulnerable | | quantum\_security\_management | r81.20 | r81.20 | vulnerable | | quantum\_security\_management | r81.20 | r81.20 | vulnerable | | quantum\_security\_management | r81.20 | r81.20 | vulnerable | | quantum\_security\_management | r81.20 | r81.20 | vulnerable | | quantum\_security\_management | r82 | r82 | vulnerable | | quantum\_security\_management | r82 | r82 | vulnerable | | quantum\_security\_management | r82 | r82 | vulnerable | | quantum\_security\_management | r82 | r82 | vulnerable | | quantum\_security\_management | r82 | r82 | vulnerable | | quantum\_security\_management | r82 | r82 | vulnerable | | quantum\_security\_management | r82 | r82 | vulnerable | | quantum\_security\_management | r82 | r82 | vulnerable | | quantum\_security\_management | r82 | r82 | vulnerable | | quantum\_security\_management | r82 | r82 | vulnerable | | quantum\_security\_management | r82 | r82 | vulnerable | | quantum\_security\_management | r82 | r82 | vulnerable | | quantum\_security\_management | r82 | r82 | vulnerable | | quantum\_security\_management | r82 | r82 | vulnerable | | quantum\_security\_management | r82 | r82 | vulnerable | | quantum\_security\_management | r82 | r82 | vulnerable | | quantum\_security\_management | r82 | r82 | vulnerable | | quantum\_security\_management | r82 | r82 | vulnerable | | quantum\_security\_management | r82 | r82 | vulnerable | | quantum\_security\_management | r82 | r82 | vulnerable | | quantum\_security\_management | r82 | r82 | vulnerable | | quantum\_security\_management | r82 | r82 | vulnerable | | quantum\_security\_management | r82.10 | r82.10 | vulnerable | | quantum\_security\_management | r82.10 | r82.10 | vulnerable | | quantum\_security\_management | r82.10 | r82.10 | vulnerable | | quantum\_security\_management | r82.10 | r82.10 | vulnerable | | quantum\_security\_management | r82.10 | r82.10 | vulnerable | | quantum\_security\_management | r82.10 | r82.10 | vulnerable | | quantum\_security\_management | r82.10 | r82.10 | vulnerable | | quantum\_security\_management | r82.20 | r82.20 | vulnerable | ## Related weakness (CWE) CWE-22 ## Remediation plan 1 ### Apply official patches Download and install the latest Jumbo Hotfix Accumulator from the Check Point Support Center (sk1000171) specifically designed to address this directory traversal and file upload flaw. 2 ### Update affected systems Ensure all Quantum and Multi-Domain Security Management installations running versions R80, R81.10, R81.20, R82, R82.10, or R82.20 are upgraded to the fixed versions specified in the vendor's security advisory. 3 ### Restrict access Immediately isolate Management Servers from the public internet and restrict access to the management interface (Gaia Portal and APIs) to a dedicated, firewalled administrative subnet using strict IP allowlists. 4 ### Monitor for exploitation Perform a forensic audit of the file system for unexpected scripts in web-accessible directories and review audit logs for unauthorized configuration changes or suspicious administrative logins. ## Detection Guidance "Monitor web server and API logs for HTTP POST requests containing directory traversal sequences, such as '../' or its URL-encoded variants (%2e%2e%2f), especially targeting file upload endpoints. Look for unexpected file creation events in the /web/conf/ or /opt/CPsuite/ directories. Additionally, alert on any unusual outbound network connections from the Management Server or the execution of shell commands by the web server process user." ## References [https://support.checkpoint.com/results/sk/sk1000171 Mitigation Patch Vendor Advisory ](https://support.checkpoint.com/results/sk/sk1000171)[https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/ Vendor Advisory ](https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/)[https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field\_cve=CVE-2026-93616 US Government Resource](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-93616) ## Sources NIST National Vulnerability Database (NVD) CISA Known Exploited Vulnerabilities (KEV) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](https://www.upguard.com/contact-sales) [Free trial](https://www.upguard.com/demo)