Our automated tracking framework flagged that CISA added CVE-2026-93616 (Check Point Multiple Products) to the Known Exploited Vulnerabilities (KEV) catalog on September 25, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts.”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-93616 by September 25, 2026 — a 3-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2026-93616 |
| Vendor / product | Check Point Multiple Products |
| Vulnerability | Check Point Multiple Products Path Traversal Vulnerability |
| CVSS base score | 9.8 |
| Added to KEV | September 22, 2026 |
| Days public before listing (NVD → KEV lag) | 0 |
| Federal patch deadline | September 25, 2026 |
| Known ransomware use | No |
How This Compares to Check Point’s Track Record
This one was listed on or before its public disclosure (a lag of 0 days) — a zero-day exploited at or before the vulnerability was even published.
| Check Point in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 5 |
| Median lag (public → KEV listing) | 0 days |
| 0-day rate (exploited at or before disclosure) | 60% |
| Entries tied to known ransomware campaigns | 2 |
For perspective, the median across all 1723 tracked KEV entries is 246 days — Check Point’s exploited vulnerabilities are flagged faster than the catalog average.
Other Recent Check Point KEV Additions
The most recent Check Point vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2026-85102 | Multiple Products | September 22, 2026 | 13 | No |
| CVE-2026-16232 | SmartConsole | July 22, 2026 | 0 | No |
| CVE-2026-50751 | Security Gateway | June 8, 2026 | 0 | ⚠️ Yes |
| CVE-2024-24919 | Quantum Security Gateways | May 30, 2024 | 2 | ⚠️ Yes |
Defense guide: How to Detect Zero-day Vulnerability: Attack Chain & Defense — detection signals, attack chain and response steps for this class of attack.
What This Means for Defenders
CISA added CVE-2026-93616 to its Known Exploited Vulnerabilities (KEV) catalog, affecting Check Point Multiple Products with a CVSS base score of 9.8. This listing mandates immediate attention, especially for U.S. federal agencies facing a September 25, 2026, patching deadline. The zero-day NVD-to-KEV lag signals active exploitation was detected immediately upon public disclosure, drastically shortening the detection and response window for all organizations. The critical severity means unpatched systems are highly vulnerable to complete compromise.
Organizations using Check Point products are most exposed and should prioritize patching immediately. Given the zero-day lag, it’s highly probable that exploitation began at or very near the public disclosure date, indicating a minimal to non-existent grace period for patching before active attacks commence. Security teams should assume their systems have been targeted since the vulnerability’s public release.
If you cannot apply the patch before the deadline, restrict access to affected systems, apply network segmentation, and monitor for unusual activity indicative of exploitation attempts. Enforce strict access controls and review system logs for any signs of compromise preceding the KEV listing date. Proactive threat hunting will identify potential post-exploitation activity.
Related Coverage
- Check Point’s CVE-2026-85102 Sat Public 13 Days Before Exploitation — Above Its 0-Day Median (September 2026)
- Critical Microsoft SharePoint Flaw CVE-2026-50522 (CVSS 9.8) Added to CISA KEV (July 2026)
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
