CVE-2026-93616 affects Check Point Quantum Security Management. Previdian lists 11 version rows; examples include R82.20 with no Jumbo Hotfix, R82.10 with Jumbo Hotfix Take 44 or below, and R82 with Jumbo Hotfix Take 126 or below.

CVE-2026-93616 Exploitation Attempts Observed in the Wild — Quantum Security Management

Decision summary

What security teams need to know first

Direct answers before the deeper technical record.

What it is

CVE-2026-93616 is an unauthenticated vulnerability affecting Check Point Quantum Security Management.

Have exploitation attempts been observed?

Yes. Exploitation attempts have been reported for this vulnerability. Previdian lists it as a known exploited vulnerability. Listed in CISA KEV. Also reported by third-party sources. Confidence is confirmed.

Who is affected?

Check Point / Quantum Security Management, including R82.20 with no Jumbo Hotfix, R82.10 with Jumbo Hotfix Take 44 or below, and R82 with Jumbo Hotfix Take 126 or below.

What should we do?

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

Overview

Quantum Security Management Path Traversal

A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.

Vendor Product Affected Status

checkpoint Affected

Quantum Security Management

R82.20 with no Jumbo Hotfix R82.10 with Jumbo Hotfix Take 44 or below R82 with Jumbo Hotfix Take 126 or below R81.20 with Jumbo Hotfix Take 166 or below R81.10 (EOS) with Jumbo Hotfix Take 190 or below R81 (EOS) R80.40 (EOS) R80.30 (EOS) R80.20 (EOS) R80.10 (EOS) R80 (EOS)

Affected

Published: 22 Sep 2026
Exploitation Attempts Reported: 22 Sep 2026
Attack vector: Remote
Complexity: Low
Privileges: None
User interaction: None

CVE References

CVE Record CVE.org · CVE Record https://www.cve.org/CVERecord?id=CVE-2026-93616
support.checkpoint.com/results/sk/sk1000171 support.checkpoint.com · CVE Record https://support.checkpoint.com/results/sk/sk1000171

Exploitation evidence

Evidence of exploitation attempts

Third-party attestation and first-party sensor observation are shown separately so teams can judge the evidence chain.

Exploitation Attempts Observed in the Wild

Check Point Blog

Recorded 22 Sep 2026

A trusted third party reported exploitation attempts.

Proof of concept available

GitHub

Recorded 23 Sep 2026

Public scanner or PoC coverage increases practical exploitability.

Known exploited vulnerability sources

Per-source evidence links for KEV attestations are available through the Previdian Pro API.

Learn about Pro API access

Source	Added
Check Point Blog First	2026-09-22 13:50 UTC
CERT Polska	2026-09-22 15:22 UTC
The Hacker News	2026-09-22 19:23 UTC
CISA	2026-09-22 19:50 UTC
CVE	2026-09-22 20:01 UTC
Security Affairs	2026-09-22 20:20 UTC
Qualys ThreatPROTECT	2026-09-24 05:20 UTC
The Shadowserver	2026-09-26 00:00 UTC

Detection

Operational artifacts and observed signals

Make the evidence actionable in scanner, SOC, and edge-control workflows.

Scanner coverage

Nuclei template detected 15 Oct 2026.

View Nuclei template

Virtual patch status

No Previdian virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.

Learn about virtual patches →

Scanner Artifacts

Scanner and exploit-framework references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-93616.yaml	15 Oct 2026

Risk and context

Severity, weaknesses, and research context

CVSS v3.1

9.8 Critical

Potential damage if exploited. Separate from whether attackers are using it.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

91.6%

Estimated chance of exploitation in the next 30 days. Previdian's warning comes from evidence, not this score.

Weaknesses

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22

Recent mention · SOCRadar

14 Oct 2026

Top RCE Vulnerabilities

Top RCE Vulnerabilities A remote code execution (RCE) vulnerability is a software flaw that lets an attacker run their own code on a target system from a remote location. Exploiting vulnerabilities like this is now the m

Read full advisory

All Mentions

Recent mention · SOCRadar

Top RCE Vulnerabilities

SOCRadar · 14 Oct 2026

Top RCE Vulnerabilities A remote code execution (RCE) vulnerability is a software flaw that lets an attacker run their own code on a target system from a remote location. Exploiting vulnerabilities like this is now the m

Recent mention · The Hacker News

Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes

The Hacker News · 02 Oct 2026

Ravie LakshmananOct 02, 2026Vulnerability / Enterprise Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added a critical security flaw impacting Fortinet FortiMail to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation. The vulnerability, tracked as CVE-2026-104286 (CVSS score: 9.8), allows unauthenticated attackers to write arbitrary files on the underlying system. "An improper limitation of a pathname to a restricted directory ('path traversal') [CWE-22] and improper neutralization of NULL byte or NULL...

Recent mention · Qualys ThreatPROTECT

CISA Warns of Check Point Vulnerabilities Exploited in Attacks (CVE-2026-85102 & CVE-2026-93616)

Qualys ThreatPROTECT · 24 Sep 2026

Check Point has two vulnerabilities that are being exploited in the wild, tracked as CVE-2026-85102 & CVE-2026-93616. The Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerabilities to its Known Exploited Vulnerabilities Catalog, urging users to patch before September 25, 2026. CVE-2026-85102: Authentication Bypass and Remote Code Execution in Remote Access and Site-to-Site VPN The vulnerability has a … Continue reading "CISA Warns of Check Point Vulnerabilities Exploited in Attacks (CVE-2026-85102 & CVE-2026-93616)"

Recent mention · Security Affairs

Check Point Fixes a New Actively Exploited Critical Security Flaw

Security Affairs · 22 Sep 2026

Check Point fixes an actively exploited flaw that lets unauthenticated attackers upload and run scripts on vulnerable Security Management Servers. Check Point has released emergency hotfixes for CVE-2026-93616, a critical path traversal flaw in its Security Management Server. The security firm bug is already being exploited. Attackers can abuse the flaw without logging in to […]

Recent mention · The Hacker News

Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks

The Hacker News · 22 Sep 2026

Attackers exploited a previously unknown flaw in Check Point's Security Management Server in a handful of targeted attacks on July 23, the company said. The flaw, CVE-2026-93616, allows an attacker who can access the server's web service to run scripts on it without logging in. Check Point released a fix on September 22 for the server that controls firewall policies for the Check Point

Recent mention · CERT Polska

Krytyczna podatność w produktach firmy Check Point

CERT Polska · 22 Sep 2026

Zespół CERT Polska informuje o krytycznej podatności w produktach Check Point. Podatność jest aktywnie wykorzystywana przez atakujących.Podatność, oznaczona jako CVE-2026-93616 (CVSS 9.8), wynika z połączenia błędu typu path traversal oraz nieprawidłowej obsługi przesyłania plików. Umożliwia nieuwierzytelnionemu atakującemu umieszczenie i wykonanie dowolnych skryptów na serwerze zarządzania, co może skutkować pełnym przejęciem serwera. Istotnym warunkiem wykorzystania podatności jest dostęp do panelu zarządzania dostępnego z portu TCP/19009.Podatność dotyczy produktów Security Management...

Recent mention · Check Point Blog

Security Advisory – Action Required – Active Exploitation of CVE-2026-85102 and a Management Pre-Authentication Vulnerability CVE-2026-93616

Check Point Blog · 22 Sep 2026

As part of Check Point’s Frontier AI Readiness Program, we continue to release Jumbo hotfixes with security fixes and hardening improvements for our Firewall and Management products. This advisory addresses the active exploitation described below, and the immediate steps customers should take to protect affected systems. Check Point Research has identified active exploitation of two vulnerabilities affecting Security Gateway and Security Management: A fix for CVE-2026-85102 has been available since September 9, and customers who have applied it are already protected. CVE-2026-93616 is a...

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

Nebula-Consulting-Limited/CVE-2026-93616-PoC

github · Created 2026-09-23 02:39:46 UTC · 0 stars · AI assessment 85%

nebula031/CVE-2026-93616-PoC

github · Created 2026-09-23 02:39:46 UTC · 0 stars · AI assessment 85%

Check Point Security Management - Unauthenticated Directory Traversal to RCE

nuclei · Created Unknown

Timeline

From disclosure to observed exploitation attempts

15 Oct 2026
04:31 UTC

Nuclei template available

Scanner coverage available
26 Sep 2026
00:00 UTC

KEV confirmed by The Shadowserver

Exploitation attempts reported by an external source
24 Sep 2026
05:20 UTC

KEV confirmed by Qualys ThreatPROTECT

Exploitation attempts reported by an external source
23 Sep 2026
02:39 UTC

Public PoC available

Public proof-of-concept code published
22 Sep 2026
20:20 UTC

KEV confirmed by Security Affairs

Exploitation attempts reported by an external source
22 Sep 2026
20:01 UTC

KEV confirmed by CVE

Exploitation attempts reported by an external source
22 Sep 2026
19:50 UTC

Added to CISA KEV

Listed in the CISA Known Exploited Vulnerabilities catalog
22 Sep 2026
19:23 UTC

KEV confirmed by The Hacker News

Exploitation attempts reported by an external source
22 Sep 2026
15:22 UTC

KEV confirmed by CERT Polska

Exploitation attempts reported by an external source
22 Sep 2026
13:50 UTC

Added to Previdian KEV Feed

High-confidence, third-party report of exploitation attempts
22 Sep 2026
13:20 UTC

Added to the Previdian watchlist

Pro and Enterprise Watch users had 7 hours of early warning before CISA KEV. Also 1 hour before Previdian KEV.
22 Sep 2026
12:59 UTC

CVE published

Vulnerability disclosed publicly
18 Sep 2026
11:08 UTC

CVE ID reserved

Identifier reserved by the CNA

Pro API

Automate this intelligence

Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

Start 14-day Pro trial Read API docs

Evidence confidence and provenance
First-party sensor telemetry
PoC and scanner references
Affected versions and enrichment
Automation-ready JSON delivery

GET /api/v2/pro/kevs/CVE-2026-93616

Sample API response

{
  "cve_id": "CVE-2026-93616",
  "confidence": "Confirmed",
  "cvss_score": 9.8,
  "cvss_estimated": false,
  "epss_score": 0.91605,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "attempts": 0, "sensors": 0 }
}

CVE-2026-93616

Quantum Security Management Path Traversal

Tags

CVE References

Exploitation Attempts Observed in the Wild

Proof of concept available

Known exploited vulnerability sources

Scanner coverage

Virtual patch status

Scanner Artifacts

Weaknesses

Top RCE Vulnerabilities

All Mentions

Potential Proof of Concepts

Nuclei template available

KEV confirmed by The Shadowserver

KEV confirmed by Qualys ThreatPROTECT

Public PoC available

KEV confirmed by Security Affairs

KEV confirmed by CVE

Added to CISA KEV

KEV confirmed by The Hacker News

KEV confirmed by CERT Polska

Added to Previdian KEV Feed

Added to the Previdian watchlist

CVE published

CVE ID reserved

Automate this intelligence