CVE-2026-93616: Check Point Security Management Pre-Auth RCE (KEV)

CVE-2026-93616 is a pre-authentication directory traversal and file upload vulnerability in Check Point's management web service that lets a remote, unauthenticated attacker upload and execute arbitrary scripts on a Security Management Server, and Check Point confirms limited, pinpointed attacks were already underway before the fix shipped; CISA added it to KEV on the day of publication.

CVE-2026-93616 is a path traversal vulnerability (CWE-22-class) in the Check Point management web service. NVD's description states it is "a directory traversal and file upload vulnerability [that] allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server" (NVD).

NVD lists the CVE as "Analyzed" with a Check Point-submitted CVSS v3.1 base score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, no authentication or user interaction required, full compromise of confidentiality, integrity and availability (NVD).

Check Point's own security advisory, published 2026-09-22 alongside a related VPN-negotiation flaw (CVE-2026-85102), describes CVE-2026-93616 as "pre-authentication path traversal in Check Point management web service, leading to arbitrary-path script execution and Java class load," affecting Security Management R82.20, R82.10 (Jumbo Hotfix Take 44 or lower), R82 (Take 126 or lower), R81.20 (Take 166 or lower), R81.10 (Take 190 or lower) and R80-R80.40. The advisory states a fix was available immediately via SK1000171, and that Check Point had observed "limited, pinpointed attacks" exploiting the flaw as early as 2026-07-23, well before public disclosure (Check Point Security Advisory).

CISA added CVE-2026-93616 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-22, the same day as publication, with a required-action due date of 2026-09-25 (CISA KEV).

As of 2026-10-26, FIRST scores the probability of exploitation at 0.9161 (99.812th percentile) — among the highest EPSS scores of any CVE in this catalog — consistent with Check Point's own confirmation of pre-disclosure, pinpointed exploitation (FIRST EPSS).

Because this is a confirmed, actively exploited unauthenticated path to remote code execution on a security management platform, any Check Point Security Management Server on an affected take should apply SK1000171 immediately and review management-interface exposure and logs for signs of the pinpointed activity Check Point has already observed.

• Pre-authentication directory traversal and file upload lets an unauthenticated attacker upload and execute arbitrary scripts on Check Point Management Server. — NVD
• CVSS v3.1 base score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, NVD status Analyzed. — NVD
• Affects Security Management R82.20, R82.10 (Jumbo Hotfix Take 44 or lower), R82 (Take 126 or lower), R81.20 (Take 166 or lower), R81.10 (Take 190 or lower), R80-R80.40; fix available via SK1000171; Check Point observed limited, pinpointed attacks as early as 2026-07-23. — Check Point Security Advisory
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-09-22, due date 2026-09-25. — CISA KEV
• EPSS score is 0.9161 (99.812th percentile) as of 2026-10-26. — FIRST EPSS