CVE-2026-93616

Check Point Multiple Products Path Traversal Exploitation (CVE-2026-93616)

Initial Access Discovery Last updated:

Detects exploitation attempts against CVE-2026-93616, a path traversal vulnerability (CWE-22) affecting multiple Check Point products including Security Management Server and gateways. Listed in CISA KEV, this flaw allows unauthenticated attackers to read arbitrary files outside the intended web root by supplying directory traversal sequences (e.g. ../../) in HTTP request paths or parameters against exposed management/portal interfaces. This detection surfaces traversal patterns in Check Point access/HTTP logs, web proxy telemetry, and firewall logs, along with post-exploitation indicators such as access to sensitive configuration and credential files.

Vulnerability Intelligence

KEV — Known Exploited

Affected Software

Vendor
Check Point
Product
Multiple Products

Weakness (CWE)

CWE-22

Timeline

Disclosed
September 22, 2026

CVSS

Unscored
CVSS vector not yet published
Write-up coming soon

What is CVE-2026-93616 Check Point Multiple Products Path Traversal Exploitation (CVE-2026-93616)?

Check Point Multiple Products Path Traversal Exploitation (CVE-2026-93616) (CVE-2026-93616) maps to the Initial Access and Discovery tactics — the adversary is trying to get into your network in MITRE ATT&CK.

This page provides production-ready detection logic for Check Point Multiple Products Path Traversal Exploitation (CVE-2026-93616), covering the data sources and telemetry it touches: Check Point CommonSecurityLog, Web proxy / firewall HTTP logs. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Initial Access Discovery
Microsoft Sentinel / Defender
kusto 
let traversalPatterns = dynamic(["../", "..%2f", "..%2F", "%2e%2e%2f", "%2e%2e/", "..\\", "..%5c", "%252e%252e"]);
let sensitiveTargets = dynamic(["/etc/passwd", "/etc/shadow", "conf/database", "CPprofile", "ICAcertificates", "/config/", ".pem", ".key"]);
CommonSecurityLog
| where DeviceVendor == "Check Point"
| where isnotempty(RequestURL) or isnotempty(AdditionalExtensions)
| extend uri = tolower(coalesce(RequestURL, AdditionalExtensions))
| where uri has_any (traversalPatterns)
| extend hitSensitive = uri has_any (sensitiveTargets)
| project TimeGenerated, DeviceVendor, DeviceProduct, SourceIP, DestinationIP, DestinationPort, RequestURL, uri, hitSensitive, DeviceAction
| order by TimeGenerated desc

Identifies HTTP requests to Check Point products containing path traversal sequences targeting sensitive files, indicative of CVE-2026-93616 exploitation.

high severity medium confidence

Data Sources

Check Point CommonSecurityLog Web proxy / firewall HTTP logs

Required Tables

CommonSecurityLog

False Positives

  • Vulnerability scanners (Nessus, Qualys) probing for path traversal during authorized assessments
  • Security researchers or red teams validating patch status
  • Legitimate URLs that contain encoded sequences resembling traversal in query parameters

Sigma rule & cross-platform mapping

The detection logic for Check Point Multiple Products Path Traversal Exploitation (CVE-2026-93616) (CVE-2026-93616) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: network_connection
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for CVE-2026-93616 Sigma rules on detection.fyi

Platform-specific guides for CVE-2026-93616

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-09-23 Research depth: standard
References (5)

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Basic path traversal request to Check Point portal

    Expected signal: Check Point access/HTTP log entry showing a request URI containing ../ sequences targeting /etc/passwd.

  2. Test 2URL-encoded traversal to sensitive config file

    Expected signal: HTTP log containing %2e%2e%2f encoded traversal directed at a config file path.

  3. Test 3Windows PowerShell traversal probe

    Expected signal: Check Point log showing ..%5c backslash-encoded traversal targeting a sensitive file from the Windows source IP.

Response Playbook

Triage

  1. Confirm the source IP is external/untrusted and identify the targeted Check Point product (Security Management Server, gateway, portal) and its interface exposure.
  2. Decode the full request URI and determine which files or directories the traversal sequence targeted (e.g. /etc/passwd, configuration DB, certificate/key files).
  3. Check whether the affected Check Point device is patched per Check Point sk1000171 and whether the management interface is internet-exposed.
  4. Correlate the source IP against threat intel and CISA KEV exploitation reporting to distinguish opportunistic scanning from targeted attack.

Containment

  1. Restrict access to the Check Point management/portal interface to trusted management networks only via firewall/ACL, removing internet exposure.
  2. Apply the Check Point hotfix/patch referenced in sk1000171 to all affected products.
  3. Block the offending source IP(s) at the perimeter if traversal returned HTTP 200 or sensitive file content.

Evidence Collection

  1. Preserve Check Point access/HTTP logs, firewall logs, and any web server logs showing the traversal requests and response codes/sizes.
  2. Capture the full request/response payloads to determine which files were successfully exfiltrated (e.g. certificates, config, credential stores).

Escalation Criteria

  • ! Escalate to incident response if a traversal request returned HTTP 200 with sensitive file content (passwd/shadow, private keys, config DB).
  • ! Escalate if the same source performed follow-on authentication or configuration changes indicating successful compromise of the management plane.

Investigation Guide

Forensic Artifacts

  • > Check Point access/HTTP logs containing traversal URIs with 2xx responses
  • > Unexpected reads of /etc/passwd, /etc/shadow, certificate (.pem/.key) or configuration database files
  • > Outbound data transfer sizes correlated to sensitive file exfiltration

Tuning Guidance

Whitelist known authorized vulnerability scanner source IPs to reduce benign matches. Tune the sensitive-target list to your environment's actual Check Point file paths, and prioritize alerts where the traversal request returned a 2xx status or a response body size larger than typical error pages, which strongly indicates successful arbitrary file read.

Hunting Queries

Aggregate path traversal attempts against Check Point devices by source IP to find high-volume or persistent attackers.

Hunting — KQL
kql 
CommonSecurityLog | where DeviceVendor == "Check Point" | extend uri=tolower(coalesce(RequestURL, AdditionalExtensions)) | where uri has_any ("../","..%2f","%2e%2e%2f","..%5c") | summarize count(), makeset(uri) by SourceIP | order by count_ desc
Hunting — SPL
spl 
index=network vendor="Check Point" | eval uri=lower(coalesce(request_url,url)) | where match(uri,"(\.\.[\/\\]|%2e%2e%2f)") | stats count values(uri) by src_ip | sort - count

Atomic Red Team Tests

Test 1 Basic path traversal request to Check Point portal
linux

Send an HTTP request with directory traversal sequences to a Check Point interface to simulate CVE-2026-93616 exploitation.

Command

bash 
curl -sk 'https://checkpoint-mgmt.lab.local/../../../../etc/passwd' -o /tmp/cp_trav_test.txt

Cleanup

bash 
rm -f /tmp/cp_trav_test.txt

Expected Telemetry

Check Point access/HTTP log entry showing a request URI containing ../ sequences targeting /etc/passwd.

Expected Detection

KQL/SPL rules match the traversal pattern in RequestURL against a Check Point device vendor.

Test 2 URL-encoded traversal to sensitive config file
linux

Use URL-encoded traversal sequences to attempt reading a Check Point configuration/key file.

Command

bash 
curl -sk 'https://checkpoint-mgmt.lab.local/portal?file=%2e%2e%2f%2e%2e%2f%2e%2e%2fconfig%2fdatabase.conf' -o /tmp/cp_enc_test.txt

Cleanup

bash 
rm -f /tmp/cp_enc_test.txt

Expected Telemetry

HTTP log containing %2e%2e%2f encoded traversal directed at a config file path.

Expected Detection

Detection rules decode/match encoded traversal patterns and flag sensitive-target access.

Test 3 Windows PowerShell traversal probe
windows

Simulate a traversal probe from a Windows host against a Check Point management interface.

Command

powershell 
powershell -Command "Invoke-WebRequest -Uri 'https://checkpoint-mgmt.lab.local/..%5c..%5c..%5cetc/shadow' -SkipCertificateCheck -OutFile $env:TEMP\cp_win_trav.txt"

Cleanup

powershell 
powershell -Command "Remove-Item $env:TEMP\cp_win_trav.txt -Force -ErrorAction SilentlyContinue"

Expected Telemetry

Check Point log showing ..%5c backslash-encoded traversal targeting a sensitive file from the Windows source IP.

Expected Detection

Rules match backslash/encoded traversal variants against Check Point vendor traffic.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0007Discovery

Related Techniques

T1190Exploit Public-Facing ApplicationT1083File and Directory Discovery

Same Tactic: Initial Access

Popular Detections