Vulnerability threat dossier
A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.
VTP analyst assessment
CVE-2026-93616 affects Check Point Management Server. An unauthenticated attacker can use directory traversal and file upload to upload and execute arbitrary scripts. CERT-FR says the vendor reports active exploitation, and ENISA lists the flaw as known exploited.
3 record references and 2 source references passed trusted post-response validation. The current deterministic record contains 1 independent evidence group.
The Check Point VPN report mapped to this CVE concerns CVE-2026-85102 and does not add context here.
First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.
If you use affected Check Point Management Server products, apply the vendor's remediation immediately.
VTP deterministic assessment
CISA KEV lists this vulnerability as known to be exploited globally.
EPSS is 0.20; this is predictive context, not exploitation evidence.
First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.
Material change ledger
Claim provenance
2 primary sources · 0 dependent secondary reports · 3 reports with unresolved independence. Repetition remains visible without multiplying confirmation.
Event history
BleepingComputer supplied a deterministically extracted signal; review the linked evidence before escalation.
CERT-FR published evidence linked to CVE-2026-93616.
ENISA EU KEV reports known exploitation. This is public intelligence, not a VTP sensor observation.
CISA lists global known exploitation. This is not a VTP sensor observation.
Original publications
Cybersecurity company Check Point has confirmed active exploitation of CVE-2026-85102, a pre-authentication remote code execution (RCE) vulnerability in the VPN certificate-handling functionality of its Security Gateway product. [...]
Une vulnérabilité a été découverte dans Check Point Security Management Server. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance et une atteinte à l'intégrité des données. L'éditeur indique que la vulnérabilité CVE-2026-93616 est activement exploitée. Check...
Attackers exploited a previously unknown flaw in Check Point's Security Management Server in a handful of targeted attacks on July 23, the company said. The flaw, CVE-2026-93616, allows an attacker who can access the server's web service to run scripts on it without logging in. Check Point released a fix on September 22 for the server that controls firewall policies for the Check Point
Check Point Software released emergency hotfixes to address a critical Security Management Server vulnerability that could let attackers run arbitrary scripts. [...]
ENISA EU KEV lists this vulnerability as known to be exploited. This is public intelligence, not a VTP sensor observation.
Technical vulnerability data
Raw observations
First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.