{"vulnerability": "CVE-2026-93616", "sightings": [{"uuid": "9854a154-12f0-462b-b670-f1688cb39cb1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-93616", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117314933627769998", "content": "Check Point Quantum Security Management is affected by CVE-2026-93616 (CRITICAL, CVSS 9.8): unauthenticated attackers can upload & execute scripts via path traversal. Restrict access & monitor activity until patch info is released. https://radar.offseq.com/threat/cve-2026-93616-cwe-22-improper-limitation-of-a-pathname-to-a-restricted-directory-path-traversal-in-4344dfa6a4d98182 #OffSeq #CheckPoint #CyberAlert", "creation_timestamp": "2026-09-22T13:30:26.846790Z"}, {"uuid": "d1b9a7cf-af2d-4389-a651-edfbd78e1c5e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-93616", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mw4djel2lp2y", "content": "CVE-2026-93616 (CRITICAL): Path traversal in Check Point Quantum Security Management allows unauthenticated script uploads & execution. Restrict access, monitor uploads. Patch status unknown. https://radar.offseq.com/threat/cve-2026-93616-cwe-22-improper-limitation-of-a-pathname-to-a-restricted-d...", "creation_timestamp": "2026-09-22T13:30:29.466050Z"}, {"uuid": "93042ce7-933c-44da-af54-ef286ba31058", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93616", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mw4f2v4v5c2o", "content": "A critical exploited Check Point Management vulnerability (CVE-2026-93616) allows attackers to execute arbitrary scripts. Secure your servers now.\n\n#CheckPoint #CVE202693616 #Cybersecurity #InfoSec #Vulnerability #RCE", "creation_timestamp": "2026-09-22T13:58:10.020668Z"}, {"uuid": "c8430f52-b21a-45b6-a776-540344525e6a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93616", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mw4f6g2tw525", "content": "CVE-2026-93616 - quantum security management\nAn unauthenticated user can upload a file and make the Check Point Management Server execute it. This could give the attacker control over the server and any connected\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#checkpoint #CVE #infosec", "creation_timestamp": "2026-09-22T14:00:08.291230Z"}, {"uuid": "8eb82b08-91ff-4798-8a37-819a56eeaf6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93616", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mw4flv4ffd24", "content": "\ud83d\udea8 CVE-2026-93616 \u2014 CVSS 9.8 CRITICAL\n\nA directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execut...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-93616\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-22T14:07:40.896956Z"}, {"uuid": "02b057ba-92e4-4377-94b3-7152edf237c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93616", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/33cggazd6rbwf", "content": "CVE-2026-93616 - Directory Traversal and File upload allows execution of arbitrary script on the Management Server\nCVE ID : CVE-2026-93616\n \n Published : Sept. 22, 2026, 1:17 p.m. | 19\u00a0minutes ago\n \n Description : A directory traversal and file upload vulnerability allows an u...", "creation_timestamp": "2026-09-22T14:17:48.438739Z"}, {"uuid": "998ff634-f247-420b-bc6f-73cbe10a1d42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-93616", "type": "seen", "source": "https://www.acn.gov.it/portale/w/checkpoint-rilevato-sfruttamento-in-rete-della-cve-2026-93616", "content": "", "creation_timestamp": "2026-09-22T16:15:38.393254Z"}, {"uuid": "b3573c33-2af5-4b1b-860e-a0f02423b0ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-93616", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/check-point-security-advisory-av26-902", "content": "", "creation_timestamp": "2026-09-22T16:15:40.639057Z"}, {"uuid": "7a02397d-77ae-4975-b4d0-03ab1b85a363", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93616", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mw4p553iry2z", "content": "\ud83e\udd16 CVE-2026-93616: Check Point Management Server path traversal 0-day exploited in the wild. Unauthenticated attackers upload + execute arbitrary scripts. Hotfix in R82.20.\nhttps://www.bleepingcomputer.com/news/security/check-point-patches-management-server-zero-day-exploited-in-attacks/", "creation_timestamp": "2026-09-22T16:58:22.567966Z"}, {"uuid": "cd237b8d-fd1a-422c-93d7-a0f6273bf6a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93616", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mw4x53dpiw2a", "content": "CVE-2026-93616 enables unauthenticated script execution via path traversal in Check Point Security Management Server, fixed September 22, while separate VPN attempts target CVE-2026-85102.\n", "creation_timestamp": "2026-09-22T19:21:31.561472Z"}, {"uuid": "76dff1cb-896c-4dad-bee1-c773b2ff11fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-93616", "type": "seen", "source": "https://bsky.app/profile/hexonbot.bsky.social/post/3mw4qwejasm2g", "content": "Check Point CVE-2026-93616 is under active exploitation. Restrict TCP 19009, install the right hotfix, and hunt exposed management servers before declaring recovery. https://www.hexon.bot/blog/check-point-cve-2026-93616 #Cybersecurity #CheckPoint #IncidentResponse", "creation_timestamp": "2026-09-22T17:30:23.018966Z"}, {"uuid": "8b7b06e2-8b1d-48bd-a2d1-7d690b2a42e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93616", "type": "seen", "source": "https://bsky.app/profile/windowsforum.com/post/3mw4slokteq2c", "content": "Patch Check Point management servers: CVE-2026-93616 is exploited. EvilTokens hit 12,000 M365 accounts\u2014restrict device-code auth. PC Manager reclaimed 9.1GB, but Boost was modest. HGST/WD had lower HDD failure than Seagate. +26 more stories", "creation_timestamp": "2026-09-22T18:00:12.543592Z"}, {"uuid": "f971eeab-dc0e-4195-b1de-95d340e31314", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93616", "type": "seen", "source": "https://bsky.app/profile/entorisec.bsky.social/post/3mw4sxokfjw27", "content": "Check Point patched CVE-2026-93616 today, a path traversal in its Security Management Server letting unauthenticated attackers upload and execute scripts. Check Point says it is aware of a handful of customers already attacked. Emergency hotfixes are out in R82.20.", "creation_timestamp": "2026-09-22T18:06:55.383083Z"}, {"uuid": "4f243423-cbd5-43d4-aaee-bc716ce402ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93616", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117316174685760658", "content": "\ud83d\udea8 Check Point patches Management Server zero-day exploited in attacks\u2800Check Point has released fixes for CVE-2026-93616, a vulnerability that allows unauthenticated attackers to upload and execute arbitrary scripts on affected management servers.\u2800The company says a small number of customers have already been attacked.\u2800Affected products include:\n\u2022 Security Management Server\u2022 Multi-Domain Security Management Server\u2022 Log Server\u2022 Multi-Domain Log Server\u2022 SmartEvent\u2800The vulnerability carries a CVSS score of 9.8.\u2800Check Point advises installing the applicable fixes, restricting management access to trusted IP addresses, and checking for signs of exploitation.\u2800LivePatch Take 28/29 does not fix this vulnerability.\nSource: https://www.bleepingcomputer.com/news/security/check-point-patches-management-server-zero-day-exploited-in-attacks/", "creation_timestamp": "2026-09-22T18:46:03.992313Z"}, {"uuid": "8dbdce8d-13fe-4b24-b7bc-283b0bdc2ab6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93616", "type": "seen", "source": "https://bsky.app/profile/samilaiho.com/post/3mw4whbhgxk2x", "content": "sk1000171 - CVE-2026-93616: Directory Traversal and File upload allows execution of arbitrary script on the Management Server\n\nsupport.checkpoint.com/results/sk/s...\n\nCVSS: 9.8 - Actively exploited", "creation_timestamp": "2026-09-22T19:09:21.985274Z"}, {"uuid": "b6452dad-a3b3-42a0-9695-fdd3de75840a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93616", "type": "seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mw4x54w3kv2l", "content": "CVE-2026-93616 enables unauthenticated script execution via path traversal in Check Point Security Management Server, fixed September 22, while separate VPN attempts target CVE-2026-85102.\n", "creation_timestamp": "2026-09-22T19:21:33.151631Z"}, {"uuid": "e4b74ba9-13be-42c5-af75-f8156932919b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93616", "type": "seen", "source": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mw4x62vs7i2z", "content": "CVE-2026-93616 enables unauthenticated script execution via path traversal in Check Point Security Management Server, fixed September 22, while separate VPN attempts target CVE-2026-85102.\n", "creation_timestamp": "2026-09-22T19:22:04.571821Z"}, {"uuid": "9e1c1da5-4f12-4af2-b6e5-cdb8d796acbd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93616", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mw4yhs5bnx2q", "content": "Check Point released emergency hotfixes for CVE-2026-93616, a critical path traversal flaw in Security Management Server products being exploited in the wild, enabling unauthenticated script execution. #CheckPoint #CVE202693616 #SmartConsole", "creation_timestamp": "2026-09-22T19:45:24.224603Z"}, {"uuid": "0257ba9d-58b8-4813-8122-c5442a4904b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93616", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-a0f6118a-c853070929b5bef7", "content": "Check Point fixes an actively exploited flaw that lets unauthenticated attackers upload and run scripts on vulnerable Security Management Servers. Check Point has released emergency hotfixes for CVE-2026-93616, a critical path traversal flaw in its Security Management Server. The security firm bug is already being exploited. Attackers can abuse the flaw without logging in to [\u2026]Check Point Fixes a New Actively Exploited Critical Security Flaw", "creation_timestamp": "2026-09-22T19:47:05.790314Z"}, {"uuid": "ed604fbc-d7c9-4642-8063-a73198db999c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93616", "type": "seen", "source": "https://bsky.app/profile/cybersecurity.poliverso.org.ap.brid.gy/post/3mw4ykt2ansx2", "content": "Check Point fixes an actively exploited flaw that lets unauthenticated attackers upload and run scripts on vulnerable Security Management Servers. Check Point has released emergency hotfixes for CVE-2026-93616, a critical path traversal flaw in its Security Management Server. The security firm [\u2026]", "creation_timestamp": "2026-09-22T19:47:11.421452Z"}, {"uuid": "2dd59212-e28f-439b-83ca-d34195e525a0", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93616", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/975b31d4-5e64-4d1b-835c-d3df7c553d84", "content": "", "creation_timestamp": "2026-09-22T20:00:03.541927Z"}, {"uuid": "0509eb41-b83d-46df-b530-aef1880065b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93616", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mw4zjc5opm25", "content": "\ud83d\uded1 CVE-2026-93616\nCheck Point Multiple Products\nCVSS 9.8 / KEV: No\nTL;DR: A directory traversal and file upload vulnerability allows an unauthenticated attacker \u2026\nhttps://cvesentinel.com/report/CVE-2026-93616?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-09-22T20:04:08.098760Z"}, {"uuid": "56e5b735-ed32-4cc0-bcd5-ee772cc8db0f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-93616", "type": "seen", "source": "https://bsky.app/profile/etairos-ai.bsky.social/post/3mw4zn3mv562e", "content": "Check Point Management Server zero-day: 61 days from exploit to fix.\nCVE-2026-93616. Your management plane sets policy for every gateway it touches.\n#ThreatIntel #ICS #CyberSecurity\nhttps://threat-intelligence.redeyesecurity.com/blog/check-point-management-server-zero-day-cve-2026-93616", "creation_timestamp": "2026-09-22T20:06:16.113544Z"}, {"uuid": "2669f4aa-547a-497f-ad57-1448288a9598", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-93616", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuudet/haavoittuvuus-2026-29", "content": "", "creation_timestamp": "2026-09-22T20:45:02.033732Z"}, {"uuid": "4f12f2dc-6d9a-42de-b05a-ddb6b6b61762", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93616", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mw54nyelcd24", "content": "Check Point disclosed CVE-2026-93616, a path traversal zero-day in Security Management Server web services used in targeted attacks, and released fixes plus hunting guidance. #CheckPoint #ZeroDay #VPN", "creation_timestamp": "2026-09-22T21:00:27.507323Z"}, {"uuid": "08e61cfb-66fa-4f31-8412-375e58ec024c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93616", "type": "seen", "source": "https://bsky.app/profile/deafnews-auto.bsky.social/post/3mw557veelt2x", "content": "Check Point Patches Zero-Day CVE-2026-93616 in Management Server: CVSS 9.8", "creation_timestamp": "2026-09-22T21:10:27.557291Z"}, {"uuid": "9bf5f44d-2c9b-43a2-ac8a-2c9a9ed8b777", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93616", "type": "seen", "source": "https://infosec.exchange/users/tomcat/statuses/117316775403622589", "content": "\u203c\ufe0f Check Point is warning customers about a newly disclosed Security Management Server zero-day exploited in targeted attacks in July.\nCVE-2026-93616 lets an attacker who can reach the web service upload and run scripts without logging in. A fix landed Sept. 22.\nHere's what admins should hunt for: https://thehackernews.com/2026/09/check-point-warns-of-management-server.html", "creation_timestamp": "2026-09-22T21:18:49.732618Z"}, {"uuid": "2e4854f6-e409-4c96-9089-83944e5ce9ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93616", "type": "seen", "source": "https://thehackernews.com/2026/09/check-point-warns-of-management-server.html", "content": "Attackers exploited a previously unknown flaw in Check Point's Security Management Server in a handful of targeted attacks on July 23, the company said.\n\nThe flaw, CVE-2026-93616, allows an attacker who can access the server's web service to run scripts on it without logging in. Check Point released a fix on September 22 for the server that controls firewall policies for the Check Point", "creation_timestamp": "2026-09-22T22:00:40.815629Z"}, {"uuid": "0b1d4009-48a1-4371-af84-253ca612c3e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93616", "type": "seen", "source": "https://bsky.app/profile/csirts.com/post/3mw5ddm77ip2c", "content": "\ud83d\udea8 Added to CISA KEV \u2014 actively exploited:\nCVE-2026-93616: Check Point Multiple Products Path Traversal Vulnerability\n\nhttps://www.csirts.com/cve/CVE-2026-93616", "creation_timestamp": "2026-09-22T22:59:55.206555Z"}]}