Check Point Management Products Vulnerable to Unauthenticated Path Traversal Attack

Vulnerability Overview

CISA has disclosed CVE-2026-93616, a path traversal vulnerability affecting multiple Check Point management products. The flaw impacts Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent. The vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on affected systems, presenting a significant risk to organizations relying on these platforms for security management.

Risk to Saudi Institutions

Path traversal vulnerabilities enable attackers to access files and directories outside the intended scope, and in this case, to execute malicious code without authentication. For regulated institutions in the Kingdom operating Check Point management infrastructure, this represents a critical exposure, particularly for systems accessible from the internet. The vulnerability could allow adversaries to compromise security management platforms that control broader network defenses.

Remediation Guidance

CISA guidance references its BOD 26-04 framework for prioritizing security updates based on risk and forensics triage requirements. Organizations are instructed to apply vendor-supplied mitigations immediately. Where mitigations are unavailable, discontinuation of the affected product is recommended. Federal agencies in the United States face a remediation deadline of 25 September 2026, providing a reference timeline for urgency.

Institutions must assess which Check Point management assets are exposed to the internet and prioritize patching accordingly. Cloud service deployments require particular attention to ensure applicable guidance is followed.