CVE-2026-93616: listed in the CISA KEV catalog

CVE-2026-93616 · CVSS 9.8 CRITICAL · KEV 2026-09-22

A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.

Is CVE-2026-93616 exploited?

• Listed in the CISA KEV catalog on 2026-09-22.
• Federal remediation due 2026-09-25.

Which products and versions are affected?

• checkpoint · Quantum Security Management · R82.20 with no Jumbo Hotfix, R82.10 with Jumbo Hotfix Take 44 or below, R82 with Jumbo Hotfix Take 126 or below, R81.20 with Jumbo Hotfix Take 166 or below, R81.10 (EOS) with Jumbo Hotfix Take 190 or below, R81 (EOS), +5 more

Is there a patch?

No patch identifier recorded here yet.

What PlainSec published about CVE-2026-93616

• Check Point Management Plane Under Active Exploit (2026-09-22)

Primary sources

• NVD record
• CISA KEV catalog

What this record does not say

• No EPSS score.
• No patch identifier.
• No exploit assessment.

KEV and EPSS are re-checked daily. Record last updated 2026-09-22.