CVE-2026-93616 IBM QRadar · QRadar

Detect Check Point Multiple Products Path Traversal Exploitation (CVE-2026-93616) in IBM QRadar

Detects exploitation attempts against CVE-2026-93616, a path traversal vulnerability (CWE-22) affecting multiple Check Point products including Security Management Server and gateways. Listed in CISA KEV, this flaw allows unauthenticated attackers to read arbitrary files outside the intended web root by supplying directory traversal sequences (e.g. ../../) in HTTP request paths or parameters against exposed management/portal interfaces. This detection surfaces traversal patterns in Check Point access/HTTP logs, web proxy telemetry, and firewall logs, along with post-exploitation indicators such as access to sensitive configuration and credential files.

MITRE ATT&CK

Tactic
Initial Access Discovery

QRadar Detection Query

IBM QRadar (QRadar)
sql 
SELECT sourceip, destinationip, destinationport, "URL", "Request URL", QIDNAME(qid) AS event_name, starttime
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%Check Point%'
AND (
  LOWER("URL") LIKE '%../%'
  OR LOWER("URL") LIKE '%..%2f%'
  OR LOWER("URL") LIKE '%%2e%2e%2f%'
  OR LOWER("URL") LIKE '%..%5c%'
)
ORDER BY starttime DESC LAST 24 HOURS
high severity medium confidence

QRadar AQL detecting path traversal payloads in URLs logged by Check Point devices for CVE-2026-93616.

Data Sources

QRadar Check Point DSMWeb proxy events

Required Tables

events

False Positives & Tuning

  • Vulnerability management scans
  • Red team validation traffic
  • Legitimate traffic with encoded characters

Other platforms for CVE-2026-93616

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Basic path traversal request to Check Point portal

    Expected signal: Check Point access/HTTP log entry showing a request URI containing ../ sequences targeting /etc/passwd.

  2. Test 2URL-encoded traversal to sensitive config file

    Expected signal: HTTP log containing %2e%2e%2f encoded traversal directed at a config file path.

  3. Test 3Windows PowerShell traversal probe

    Expected signal: Check Point log showing ..%5c backslash-encoded traversal targeting a sensitive file from the Windows source IP.

Last updated: 2026-09-23 Research depth: standard
References (5)

Response Playbook

Triage

  1. Confirm the source IP is external/untrusted and identify the targeted Check Point product (Security Management Server, gateway, portal) and its interface exposure.
  2. Decode the full request URI and determine which files or directories the traversal sequence targeted (e.g. /etc/passwd, configuration DB, certificate/key files).
  3. Check whether the affected Check Point device is patched per Check Point sk1000171 and whether the management interface is internet-exposed.
  4. Correlate the source IP against threat intel and CISA KEV exploitation reporting to distinguish opportunistic scanning from targeted attack.

Containment

  1. Restrict access to the Check Point management/portal interface to trusted management networks only via firewall/ACL, removing internet exposure.
  2. Apply the Check Point hotfix/patch referenced in sk1000171 to all affected products.
  3. Block the offending source IP(s) at the perimeter if traversal returned HTTP 200 or sensitive file content.

Evidence Collection

  1. Preserve Check Point access/HTTP logs, firewall logs, and any web server logs showing the traversal requests and response codes/sizes.
  2. Capture the full request/response payloads to determine which files were successfully exfiltrated (e.g. certificates, config, credential stores).

Escalation Criteria

  • !Escalate to incident response if a traversal request returned HTTP 200 with sensitive file content (passwd/shadow, private keys, config DB).
  • !Escalate if the same source performed follow-on authentication or configuration changes indicating successful compromise of the management plane.

Investigation Guide

Related Techniques

[object Object][object Object]

Forensic Artifacts

  • >Check Point access/HTTP logs containing traversal URIs with 2xx responses
  • >Unexpected reads of /etc/passwd, /etc/shadow, certificate (.pem/.key) or configuration database files
  • >Outbound data transfer sizes correlated to sensitive file exfiltration

Tuning Guidance

Whitelist known authorized vulnerability scanner source IPs to reduce benign matches. Tune the sensitive-target list to your environment's actual Check Point file paths, and prioritize alerts where the traversal request returned a 2xx status or a response body size larger than typical error pages, which strongly indicates successful arbitrary file read.

Hunting Queries

Aggregate path traversal attempts against Check Point devices by source IP to find high-volume or persistent attackers.

Hunting — KQL
kql 
CommonSecurityLog | where DeviceVendor == "Check Point" | extend uri=tolower(coalesce(RequestURL, AdditionalExtensions)) | where uri has_any ("../","..%2f","%2e%2e%2f","..%5c") | summarize count(), makeset(uri) by SourceIP | order by count_ desc
Hunting — SPL
spl 
index=network vendor="Check Point" | eval uri=lower(coalesce(request_url,url)) | where match(uri,"(\.\.[\/\\]|%2e%2e%2f)") | stats count values(uri) by src_ip | sort - count

Atomic Red Team Tests

Test 1 Basic path traversal request to Check Point portal
linux

Send an HTTP request with directory traversal sequences to a Check Point interface to simulate CVE-2026-93616 exploitation.

Command

bash 
curl -sk 'https://checkpoint-mgmt.lab.local/../../../../etc/passwd' -o /tmp/cp_trav_test.txt

Cleanup

bash 
rm -f /tmp/cp_trav_test.txt

Expected Telemetry

Check Point access/HTTP log entry showing a request URI containing ../ sequences targeting /etc/passwd.

Expected Detection

KQL/SPL rules match the traversal pattern in RequestURL against a Check Point device vendor.

Test 2 URL-encoded traversal to sensitive config file
linux

Use URL-encoded traversal sequences to attempt reading a Check Point configuration/key file.

Command

bash 
curl -sk 'https://checkpoint-mgmt.lab.local/portal?file=%2e%2e%2f%2e%2e%2f%2e%2e%2fconfig%2fdatabase.conf' -o /tmp/cp_enc_test.txt

Cleanup

bash 
rm -f /tmp/cp_enc_test.txt

Expected Telemetry

HTTP log containing %2e%2e%2f encoded traversal directed at a config file path.

Expected Detection

Detection rules decode/match encoded traversal patterns and flag sensitive-target access.

Test 3 Windows PowerShell traversal probe
windows

Simulate a traversal probe from a Windows host against a Check Point management interface.

Command

powershell 
powershell -Command "Invoke-WebRequest -Uri 'https://checkpoint-mgmt.lab.local/..%5c..%5c..%5cetc/shadow' -SkipCertificateCheck -OutFile $env:TEMP\cp_win_trav.txt"

Cleanup

powershell 
powershell -Command "Remove-Item $env:TEMP\cp_win_trav.txt -Force -ErrorAction SilentlyContinue"

Expected Telemetry

Check Point log showing ..%5c backslash-encoded traversal targeting a sensitive file from the Windows source IP.

Expected Detection

Rules match backslash/encoded traversal variants against Check Point vendor traffic.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0007Discovery

Related Techniques

T1190Exploit Public-Facing ApplicationT1083File and Directory Discovery

Same Tactic: Initial Access

Popular Detections