Eclypsium report details exploited flaws in firewalls, VPNs and network appliances
InfraTrust tracked 133 new advisories covering 2,813 vulnerabilities in a month; 16 advisories involved actively exploited KEV-listed flaws.
90
CVE-2026-93616
Unauthenticated RCE in Check Point Management Server via Directory Traversal and File Upload
CISA: Check Point Multiple Products Path Traversal Vulnerability
- CVSS 3.1
- 9.8 critical
- EPSS
- 92%p100
- Published
- ·
- Added to KEV
AI analysisSummaries by Vani AI
This vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server, achieving high confidentiality, integrity, and availability through directory traversal and file upload attacks. An attacker can leverage this flaw to compromise sensitive systems and gain extensive control over the management environment. The affected scope includes all Check Point Management Server installations, with no specific version range identified in the provided data.
What to do: Upgrade to patched Check Point Management Server versions immediately; disable/block directory traversal and file upload features; audit all management server deployments and verify plugin installation status; monitor for new CVEs and update policies.
| Product | Affected |
|---|---|
| Check Point Management Server | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.
KEVCISA Known Exploited Vulnerability
- Affected
- Check Point Multiple Products
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Due date
- Ransomware use
- Unknown
- Vendors
- checkpoint
- Products
- multi-domain security management, quantum security management
- Weakness
- CWE-22
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news
19 storiesAttackers hit Check Point Management Servers and Spark firewalls, F5 BIG-IP APM instances
CISA adds four actively exploited zero-days to KEV, forcing immediate patching of critical flaws in Check Point, Arista, and F5 systems.
90
CISA Warns of Multiple Check Point Product Vulnerabilities Exploited in Attacks
CISA says two Check Point flaws, including unauthenticated remote code execution, are being exploited.
88
Hackers Exploit Critical Check Point VPN Flaws to Gain Remote Access Without Login
Check Point confirms active exploitation of two CVSS 9.8 VPN and management flaws enabling unauthenticated code execution.
88
CISA Warns of Check Point Vulnerabilities Exploited in Attacks (CVE-2026-85102 & CVE-2026-93616)
CISA says two critical Check Point VPN and management flaws are exploited in the wild.
88
Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks
Check Point says attackers exploited unauthenticated Management Server zero-day CVE-2026-93616 in targeted July attacks.
88
Check Point Management Server 0-Day Vulnerability Actively Exploited in Attacks
Check Point says attackers exploited critical Management Server zero-day CVE-2026-93616 for unauthenticated code execution.
88
Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes
CISA added exploited FortiMail flaw CVE-2026-104286, a critical unauthenticated file-write bug, to the KEV catalog.
86
CISA Adds Multiple Check Point Product Flaws to Exploited Vulnerabilities List
CISA added two actively exploited Check Point flaws, including unauthenticated VPN code execution, to KEV.
86
Check Point warns of hackers exploiting Security Gateway VPN RCE flaw
Check Point confirms active exploitation of pre-auth VPN RCE CVE-2026-85102 and zero-day CVE-2026-93616, now both in CISA KEV.
86
Check Point Patches Exploited Management Server Zero-Day
Check Point patched exploited zero-day CVE-2026-93616 in Management Server, and CISA added it and CVE-2026-85102 to KEV.
86
Check Point hacked: The security software protecting your network has become a prime attack target
Attackers are exploiting two pre-authentication Check Point firewall flaws rated CVSS 9.8.
85
Check Point Fixes a New Actively Exploited Critical Security Flaw
Check Point issued emergency hotfixes for actively exploited critical path traversal CVE-2026-93616 in Security Management Server.
85
Hackers Exploit Check Point 0-Day Flaw to Execute Code on Management Servers
Check Point says CVE-2026-93616 is exploited to run code on unauthenticated management servers.
84
Check Point warns of Management Server zero-day exploited in attacks
Check Point patched CVE-2026-93616, an exploited unauthenticated Management Server zero-day.
84
U.S. CISA adds Check Point, Arista VeloCloud Orchestrator, and F5 BIG-IP APM flaws to its Known Exploited Vulnerabilities catalog
CISA added four actively exploited Check Point, Arista VeloCloud Orchestrator, and F5 BIG-IP APM flaws to its KEV catalog, with federal fixes due September 25.
82
28th September – Threat Intelligence Report
Check Point's weekly report covers ShinyHunters' FBI jobs-site breach, Bitget's $351.6M wallet theft, and actively exploited critical RCEs in Check Point and F5 products.
80
Week in review: Gyazo breach exposes 23.6M user data, TASK#STOMP steals documents
Weekly roundup leads with a Gyazo breach of 23.6 million users and the TASK#STOMP document-stealing backdoor.
80
CISA Adds Four Known Exploited Vulnerabilities to Catalog
CISA added four actively exploited Check Point, Arista VeloCloud, and F5 BIG-IP flaws to the KEV catalog.
80