Path Traversal Vulnerability in Check Point Management and Log Servers

Catalog analysis: CISA added this entry on September 22, 2026. The entry reflects catalog information retrieved on September 23, 2026, not a snapshot archived on the inclusion date. This site’s publication date is shown separately. Check current vendor guidance before acting.

What the vulnerability is

CVE-2026-93616 is a path traversal vulnerability (CWE-22) affecting multiple Check Point security products. This flaw allows an unauthenticated attacker to upload and execute arbitrary scripts on the affected system. Because these systems often serve as central hubs for network security policy and logging, a compromise at this level could provide an attacker with significant leverage over the broader healthcare network infrastructure.

Exposure and applicability

This vulnerability applies to organizations utilizing the following Check Point products:
* Security Management Server
* Multi-Domain Security Management Server
* Log Server
* Multi-Domain Log Server
* SmartEvent

For U.S. healthcare providers and business associates, these assets are critical for maintaining the confidentiality and availability of electronic Protected Health Information (ePHI). The risk is highest for instances where these management servers are exposed to the internet. CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on September 22, 2026, indicating that it is a priority for remediation.

Remediation priorities

Our analysis suggests the following prioritized actions for healthcare security leaders and clinical engineering teams:

1. Asset Identification and Exposure Audit: Immediately identify all deployed instances of the affected Check Point products. Prioritize those with internet-facing interfaces, as these are the most likely entry points for unauthenticated attackers.
2. Vendor Mitigation Deployment: Apply mitigations according to official vendor instructions. This is the primary method to address the path traversal flaw and prevent unauthorized script execution.
3. Forensic Triage: Given that this vulnerability has been added to the Known Exploited Vulnerabilities catalog, organizations should perform forensic triage on their management servers to identify signs of prior unauthorized access or script execution.
4. Network Segmentation Review: Evaluate whether these management servers are isolated from clinical networks and patient data environments. Restricting access to these servers to authorized administrative hosts only could reduce the likelihood of an external attacker reaching the vulnerable interface.

How to validate remediation

To verify that risk has been reduced, organizations should employ the following methods:
* Version and Patch Verification: Confirm through system logs or management consoles that the vendor-recommended mitigations or updates have been successfully applied to all identified assets.
* Exposure Validation: Use authorized network scanning tools to confirm that management interfaces are no longer exposed to the public internet or are restricted to known, secure administrative IP ranges.
* Log Analysis: Review security logs for any anomalous file uploads or unexpected script executions occurring prior to and after the application of mitigations.

Limits and open questions

Applying vendor mitigations is a critical step but may not eliminate all residual risk if the system was already compromised. It remains unknown whether this vulnerability has been utilized in specific ransomware campaigns targeting the healthcare sector. Furthermore, while CISA has set a deadline of September 25, 2026, for covered federal agencies, healthcare providers must determine their own remediation timelines based on their internal risk management processes and HIPAA Security Rule obligations.

Source and editorial note

CVE-2026-93616: Check Point Multiple Products Path Traversal Vulnerability · Source date: September 22, 2026 · Retrieved September 23, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request a healthcare security assessment