> Source: [sk1000171](https://support.checkpoint.com/results/sk/sk1000171)
# sk1000171 - CVE-2026-93616: Directory Traversal and File upload allows execution of arbitrary script on the Management Server
| Property | Value |
|----------|-------|
| Solution ID | sk1000171 |
| Date Created | 2026-09-20 |
| Last Modified | 2026-10-13 |
| Technical Level | General |
| Products | Security Management Server, Multi-Domain Security Management Server |
| Versions | R82.10, R82, R81.20, R82.20, R81.10 (EOS), R81 (EOS) |
## Symptoms
- * A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on the Check Point Management Server.
This vulnerability is exploited in the Wild. Check Point is aware of a handful of customers who have been attacked.
* This issue received the ID [CVE-2026-93616](https://www.cve.org/CVERecord?id=CVE-2026-93616) and a CVSS score of 9.8.
* **Affected Products:** Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, SmartEvent.
* **Not Affected Products:**Smart-1 Cloud (fix is already applied), Check Point Firewall Appliances, Check Point Spark
Firewall.
* **Affected Versions:**
* R82.20
* R82.10 Jumbo Hotfix Take 44 or lower
* R82 Jumbo Hotfix Take 126 or lower
* R81.20 Jumbo Hotfix Take 166 or lower
* R81.10 Jumbo Hotfix Take 190 or lower (EoS)
* R80, R80.10, R80.20, R80.30, R80.40, R81 (all EoS)
Note: Check Point LivePatch Take 28/29 does not address this issue.
### Mitigation
Limit access to your Management Servers behind a Security Gateway/Check Point Firewall according to the [Check Point Gateway and Management Hardening Administration Guide](https://sc1.checkpoint.com/documents/Check_Point_Gateway_and_Management_Hardening/Hardening_GW_and_MGMT/Introduction.html).
* Make sure that access to port TCP/19009 is only possible from Trusted IP addresses.
* If you already have a Security Gateway / Check Point Firewall with implied rules enabled, make sure your Trusted Clients are limited to trusted internal IP addresses. This will create an Implied rule limiting access.
To do so:
1. In **SmartConsole** , go to **Manage \& Settings** \> **Permissions \& Administrators** \> **Trusted Clients**.
2. Double-click the client you want to edit.
3. In the **Trusted Client** configuration window that opens, change the settings as needed.
4. Click **OK.**
5.
### Indication of Compromise
Check for these indicators of compromise on every Security Management, Multi-Domain Security Management, Log, Multi-Domain Log, and SmartEvent Server. Each of the indicators below may indicate an attempt to exploit this vulnerability and should be investigated. A match does not necessarily confirm successful compromise.
The indicators represent two different stages of exploitation:
* **Indicator 1** may indicate exploitation of the authentication bypass, which can provide an unauthenticated attacker with a valid session.
* **Indicators 2.a--2.c** may indicate exploitation by a user who has already passed the authentication stage, whether through Indicator 1, stolen credentials, or another method. This stage may allow an attacker to perform directory traversal, file upload and execution of arbitrary script.
**Indicators**
1. **Authentication bypass indicator**
Run this command from Expert mode:
`grep -nHP "login\(loginRequest=LoginRequest\{authenticationInfo=AuthenticationInfoBase\{username='[^'
]{1001,}'" "$MDS_FWDIR"/log/cpm.elg*`
Output Example:
`/opt/CPsuite-R82/fw1/log/cpm.elg.13:653:17/09/26 17:30:03,562 INFO coresvc.internal.LoginSvcImpl [qtp1491953039-6857]: login(loginRequest=LoginRequest{authenticationInfo=AuthenticationInfoBase{username='abcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdababcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcd'}, connectionMode=READ_WRITE, applicationName='SmartConsole', userAgent='null', actionOnOtherClientSession=NO_ACTION, workSessionId='null', workSessionMode=USE_EXISTING, workSessionType=PRIVATE, keepAliveTimeout=0, getDomainList=true, domain=null, domainName='null', domainIp='10.x.x.x', remoteIpAddr='null', VersionDetails=VersionDetails{majorVersion='R82', minorVersion='R82', officialName='R82', smartConsoleBuild='null'}})`
If the above command returns an output, check if there is an FWM/MDS core dump file that was generated at the same time. Run:
`ls -l /var/log/dump/usermode/ | grep -e fwm -e mds`
If a core dump file was generated at the same time as the login attempt returned by the first command, there has been a potential attempt to exploit this vulnerability in your
environment.
2. **Arbitrary file operation indicators**
The following checks may indicate exploitation after the authentication stage. An attacker may have reached this stage by exploiting the authentication bypass described in Indicator 1, by using stolen credentials, or through another method.
**2a.** **Suspicious version path**
Run this command from Expert mode:
`grep -aE 'Invoking method .* in version: .*(\.|/|%2f|%2e|\\|%5c|CPupgrade-tools-\.\.)' "$MDS_FWDIR"/log/cpm.elg*`
If this command returns an output, review the matching entries for unexpected path separators, encoded path characters, directory traversal sequences, or references such as `CPupgrade-tools-...`
A match may indicate an attempt to perform arbitrary file operations.
**2.b Upload path traversal**
Run this command from Expert mode:
`grep -aE 'Uploading file .*((\.\./)+|%2e%2e%2f|%2f).*(CPupgrade-tools-|scripts/check_upgrade_tools\.s(h)?)' "$MDS_FWDIR"/log/cpm.elg*`
This check detects suspicious file upload paths containing directory traversal or encoded path separators and targeting upgrade-tools-related locations.
If this command returns an output, review the matching path and file name.
A match may indicate an attempt to perform arbitrary file operations using a manipulated upload path.
**2.c JAR path breakout**
Run this command from Expert mode:
`grep -aE 'The path to the jars: .*CPupgrade-tools-.*(\.\./|/\./|//|/temp/|/opt/CPsuite-)' "$MDS_FWDIR"/log/cpm.elg*`
This check detects suspicious JAR path resolution that may break out of the expected CPupgrade-tools directory.
If this command returns an output, review the resulting path for directory traversal sequences or references to unexpected locations.
A match may indicate an attempt to access or manipulate files outside the expected upgrade-tools directory, potentially leading to privilege escalation.
## Solution
This problem was fixed.
* **Download the** [R82.20 Security Hotfix (TAR)](https://support.checkpoint.com/results/download/145757)(does not require a reboot)
The fix is also included in:
* [Jumbo Hotfix Accumulator for R82.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82.20/index.html) starting from Take 10
* [Jumbo Hotfix Accumulator for R82.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82.10/Default.htm) starting from Take 45
* [Jumbo Hotfix Accumulator for R82](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82/Default.htm) starting from Take 127
* [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 170
* [Jumbo Hotfix Accumulator for R81.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/Default.htm) starting from Take 192
Notes:
* These Jumbo Hotfix Accumulators also include the fix for [CVE-2026-91843](https://www.cve.org/CVERecord?id=CVE-2026-91843) ([sk1000155](https://support.checkpoint.com/results/sk/sk1000155)).
* Because of the nature of the fix, a LivePatch is not be available for this issue.
---
# Agent Instructions
This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.
## Navigating This Knowledge Base
- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content