01 Record
CVE-2026-93616
Directory Traversal and File upload allows execution of arbitrary script on the Management Server
CriticalKEVPUBLISHEDCNA: checkpoint
CNA base score9.8 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
02 Description
Directory Traversal and File upload allows execution of arbitrary script on the Management Server
03 Exploitation and scoring
- Exploitation
- Exploited in the wild. Listed in the CISA Known Exploited Vulnerabilities catalog on 2026-09-22. Federal remediation due 2026-09-25.
- SSVC decision
- ExploitationactiveCISA reports credible evidence of active exploitation.
- AutomatableyesAn attacker can reliably automate reconnaissance through exploitation, so this scales.
- Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.
- EPSS probability
- Not scored by EPSS
- EPSS percentile
- Not scored by EPSS
- NVD base score
- 9.8 (CVSS v3.x), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVD analysis status
- Awaiting Analysis. NVD last modified this record on 2026-09-22.
- Red Hat severity
- No Red Hat rating. Red Hat rates the CVEs that affect its products.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2026-09-22 12:59Z9 HR AGO
- Last updated
- 2026-09-22 19:58Z2 HR AGO
- Reserved
- 2026-09-18
- Assigning CNA
- checkpoint
- Record state
- PUBLISHED
- Severity
- Critical (CVSS 9.8)
- CNA CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Base
- Data version
- 5.2
- Document digest
- 64db4b21f87fe1ebfec0582da8e847073ae8075ce2dca8a33eeeb90648868c32
05 Affected products
VendorProductVersionsPlatforms
checkpointQuantum Security ManagementR82.20 with no Jumbo Hotfix, R82.10 with Jumbo Hotfix Take 44 or below, R82 with Jumbo Hotfix Take 126 or below, R81.20 with Jumbo Hotfix Take 166 or below, R81.10 (EOS) with Jumbo Hotfix Take 190 or below, R81 (EOS), R80.40 (EOS), R80.30 (EOS), R80.20 (EOS), R80.10 (EOS), R80 (EOS)—
06 References
- support.checkpoint.comhttps://support.checkpoint.com/results/sk/sk1000171
- blog.checkpoint.comhttps://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/
- www.cisa.govhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-93616