Actively exploited in the wild. Patch or mitigate immediately — don't wait for a maintenance window.
Severity
Critical · 9.8
CVSS base score
Exploitation
In the wild
CISA KEV
Predicted risk
20% model
EPSS forecast — overtaken by confirmed exploitation
Exposure
Internet-facing
Exploitable remotely, no login, no user action
01
What's the risk?
An unauthenticated attacker, remotely over the network, with no user interaction, can fully compromise the system — steal data, tamper with it and take it offline.
A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.
How it's exploitedMITRE ATT&CK · inferred from weakness & vector
Inferred from the weakness type (CWE) and how the flaw is reached — the techniques an attacker would chain to exploit this. Real-world corroboration appears here as threat intel is folded in.
02
Who's exploiting it?
Corroborated threat activity referencing this CVE — with source and confidence, not inference.
Confirmed exploited in the wild.CISA KEV
Named threat actors and observed ATT&CK techniques appear here as intel feeds are folded in — the ATT&CK chain above stays inferred until then.
Generated by Wavense from the CVE record — an immediate mitigation and the permanent fix.
!
Mitigate now
Immediately restrict network access to the Check Point Management Server's web interface, allowing connections only from trusted administrative networks or specific IP addresses. Implement robust network intrusion detection systems (NIDS) and host-based security monitoring (HIDS) to detect anomalous file uploads, script executions, or suspicious outbound connections from the server. Regularly backup the management server configuration and data to facilitate rapid recovery if an incident occurs.
✓
Permanent fix
The permanent resolution requires applying the official vendor-provided security hotfix or upgrading the Check Point Management Server to a version that specifically addresses CVE-2026-93616. Consult Check Point's official security advisories and support channels for detailed patch availability, affected versions, and precise upgrade instructions for your specific product line. Prioritize this patch immediately due to the critical severity and unauthenticated remote code execution potential.
Technical details— weakness, CVSS vector & calculator, related CVEs
Business impact
An unauthenticated attacker can exploit this critical vulnerability to upload and execute arbitrary scripts on the Check Point Management Server. This grants full remote code execution capabilities, allowing complete control over the security infrastructure. The attacker could modify firewall policies, disable protections, exfiltrate sensitive data, and establish a foothold for further network compromise, leading to severe data breaches and system disruption.