Yes. CISA added CVE-2026-93616 to its Known Exploited Vulnerabilities catalogue on 22 September 2026, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts.
How to tell whether exploitation is real, not just suspected
For a CVE like this, the practical question is whether the issue has moved from a theoretical flaw to one that is being used against exposed systems. CISA’s KEV listing is the strongest signal available here because it is reserved for vulnerabilities with reliable evidence of active exploitation. Treat that as a confirmation signal, not just a prioritisation hint.
Path traversal matters because it can let an attacker reach files or execution paths the product should never expose. In this case the direct answer already states the affected Check Point products and that the flaw can allow arbitrary script upload and execution, which means the exposure is not limited to information disclosure. It can become full server compromise if the vulnerable management surface is reachable.
That is why “is it being exploited?” should be answered by combining KEV status, product exposure, and exploit impact. If the management server or related logging and event components are internet-facing, the operational risk is materially higher than if the service is isolated, even though a KEV listing still means the issue deserves urgent attention.
What the attack path usually means for defenders
A path traversal flaw in a management or log server is especially sensitive because those systems often sit close to privileged administration functions and telemetry. If an unauthenticated attacker can upload or execute scripts, the likely defender problem is not just initial access, but the possibility of persistence, credential theft, tampering with logs, or lateral movement from a trusted management plane.
In practice, that means defenders should think beyond the CVE name and ask what the system can reach, what accounts it can use, and what data or commands it can touch once the service is abused. The more privileged the affected server, the more serious the consequence of even a short-lived exploit window.
When an exploited vulnerability sits in a management component rather than a user-facing app, compromise assessment should focus on administrative trust boundaries, not only on webshell detection. That distinction matters because attackers frequently use management-plane access to expand control quietly and to suppress the evidence that would otherwise reveal them.
What to do before and after patching
Start by confirming whether each named Check Point product is exposed to the network, whether the product version is vulnerable, and whether any abnormal files, scripts, jobs, or process launches appeared around the KEV date. Use the vendor advisory and CISA KEV entry for authoritative version and remediation details instead of relying on second-hand summaries.
If patching or upgrade work must wait, reduce exposure immediately by removing unnecessary network reachability, restricting management access to trusted admin paths, and monitoring for script creation, unexpected uploads, or new execution artifacts. For systems that store logs or security events, also review whether the attacker could have altered or deleted records needed for forensics.
If you find signs of compromise, treat the affected server as an incident, not just a patching task. Reimage or clean the host according to your incident-response standard, then rotate any credentials, sessions, tokens, or administrative secrets that may have been accessible through that system.
Risk and Threat Considerations
This is a high-risk class of vulnerability because an unauthenticated path traversal issue in a security management or logging product can turn a management plane into an execution surface. The main concern is not only initial compromise, but the downstream ability to tamper with security controls, stage persistence, and use trusted infrastructure to hide follow-on activity.
Failure mechanism: The attacker reaches an unintended filesystem path or writable execution location, uploads a script, and executes code without authentication, bypassing the trust model of the management server.
Impact: The result can include full administrative compromise, log tampering, loss of monitoring integrity, and exposure of additional credentials or security data stored on or reachable from the server.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, CIS Controls v8 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | KEV-listed CVE requires prompt remediation and validation of vulnerable Check Point services. |
| SI-4 — System Monitoring | Active exploitation calls for monitoring uploads, script execution, and suspicious management-plane activity. | |
| Recommendation — Prioritise remediation of the vulnerable Check Point products and verify the fix is deployed. Monitor the affected servers for exploit artifacts, abnormal processes, and log tampering. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | A KEV-listed flaw should be triaged and remediated through continuous vulnerability management. |
| CIS-8 — Audit Log Management | Path traversal exploitation may affect logs and administrative visibility on security appliances. | |
| Recommendation — Prioritise this issue for expedited scanning, remediation, and exception tracking. Protect, review, and retain logs needed to confirm whether the appliance was abused. | ||
| OWASP ASVS | V15 — Secure Coding and Architecture | Path traversal is an input-handling and file-access weakness with clear architectural security implications. |
| Recommendation — Review file-path handling and restrict server-side access to intended directories only. | ||
Practitioner Guidance
What to verify: Confirm whether the affected Check Point roles are externally reachable, whether any suspicious uploads or script files exist, and whether admin access logs show unusual source IPs or timing around the KEV date.
Decision rule: If the vulnerable system is internet-facing or handles privileged security operations, prioritize containment and compromise assessment before routine maintenance work. If the system is isolated but reachable by admins, still validate that no trusted path has been abused.
What good looks like: You can show the vulnerable surface is removed or patched, the host has been checked for post-exploitation artifacts, and credentials or sessions with plausible exposure have been rotated where needed.
Practitioner takeaway: For KEV-listed management-plane vulnerabilities, the right question is not whether exploitation is possible, but whether the attacker could have turned a single reachable service into durable control.
Related resources from NHI Mgmt Group
- Guide: Edge Device Security Guide
- CVE-2026-93616 (Check Point Multiple Products Path Traversal)
- Is CVE-2026-85102 (Check Point Multiple Products Improper Certificate Validation) being exploited in the wild?
- Is CVE-2026-76519 (Cisco Secure Email Gateway Relative Path Traversal) being exploited in the wild?
- Is CVE-2024-11667 (Zyxel Multiple Firewalls Path Traversal) being exploited in the wild?