CVE-2026-93616: Check Point Management Server Path Traversal Actively Exploited — Detection and Remediation Guide

---
title: Check Point Management Web Service Spawning Shell or Interpreter
id: 3c8f1a72-9b4e-4d21-ae67-2f5c8d901234
status: experimental
description: Detects the Check Point management web stack (Tomcat/Java or httpd) spawning a shell or script interpreter — a strong post-exploitation indicator for CVE-2026-93616 arbitrary script execution.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-93616
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/23
tags:
  - attack.execution
  - attack.t1059
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/java'
      - '/httpd'
      - '/apache2'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
  condition: selection_parent and selection_child
falsepositives:
  - Check Point maintenance scripts and health-check automation — baseline parent/child pairs during a quiet window and allowlist known-good hashes
level: high
---
title: Path Traversal Attempt Against Check Point Management Interface
id: 7d2e5b91-4c3a-48f6-b912-8a4e6f102738
status: experimental
description: Detects path traversal sequences and script-upload indicators in HTTP requests directed at Check Point Security Management / SmartEvent web services. Apply to reverse proxy, WAF, or web server access logs fronting the management plane.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-93616
  - https://attack.mitre.org/techniques/T1190/
  - https://attack.mitre.org/techniques/T1083/
author: Security Arsenal
date: 2026/09/23
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
  product: linux
detection:
  selection_traversal:
    cs-uri|contains:
      - '../'
      - '..%2f'
      - '%2e%2e'
      - '..%5c'
      - '%252e%252e'
      - '..;/'
  selection_upload:
    cs-method:
      - 'POST'
      - 'PUT'
  condition: selection_traversal and selection_upload
falsepositives:
  - Rare; legitimate management portal traffic should never contain traversal sequences. Scanner traffic may match — corroborate with source reputation
level: critical
---
title: Script File Created in Check Point Web-Accessible Directory
id: 91f4c2d8-6e7b-43a5-9d01-5b8c3e247190
status: experimental
description: Detects creation of executable script files in web-served or upload directories on Check Point Gaia management servers — consistent with the arbitrary script upload phase of CVE-2026-93616 exploitation.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-93616
  - https://attack.mitre.org/techniques/T1505.003/
author: Security Arsenal
date: 2026/09/23
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection_ext:
    TargetFilename|endswith:
      - '.jsp'
      - '.jspx'
      - '.php'
      - '.sh'
      - '.py'
      - '.war'
  selection_path:
    TargetFilename|contains:
      - '/web/'
      - '/htdocs/'
      - '/webapps/'
      - '/uploads/'
      - '/tmp/'
      - '/var/tmp/'
  condition: selection_ext and selection_path
falsepositives:
  - Vendor hotfix installations and legitimate admin file transfers — correlate with approved change windows
level: high

// Hunt: CVE-2026-93616 — traversal probes and anomalous traffic to Check Point management plane
// Ingest Check Point syslog/web access logs via CEF into CommonSecurityLog
let lookback = 14d;
let mgmt_ips = dynamic(["10.0.0.15", "10.0.0.16"]); // <-- replace with your SMS/MDS/SmartEvent IPs
let traversal_patterns = dynamic(["../", "..%2f", "%2e%2e", "%252e%252e", "..;/", "..%5c"]);
CommonSecurityLog
| where TimeGenerated > ago(lookback)
| where DestinationIP in (mgmt_ips) or DeviceVendor =~ "Check Point"
| where RequestURL has_any (traversal_patterns) or Message has_any (traversal_patterns)
| extend IsScriptUpload = (RequestMethod in ("POST", "PUT") and (RequestURL has_any (".jsp", ".php", ".sh", "upload")))
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Requests=count(),
            DistinctURLs=dcount(RequestURL), SampleURL=any(RequestURL)
  by SourceIP, DestinationIP, RequestMethod, IsScriptUpload
| order by Requests desc;
// Pivot: identify ANY external source touching the management interface at all — it shouldn't happen
CommonSecurityLog
| where TimeGenerated > ago(lookback)
| where DestinationIP in (mgmt_ips) and DestinationPort in (443, 4434, 19009)
| where not(ipv4_is_private(SourceIP))
| summarize Connections=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated)
  by SourceIP, DestinationPort
| order by Connections desc;

-- Velociraptor artifact: CVE-2026-93616 post-exploitation triage on Gaia management servers
-- Deploy the Linux agent to SMS/MDS/Log Server/SmartEvent hosts (maintenance-window approved)

-- 1) Suspicious child processes of the web stack (webshell execution)
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE (Ppid IN (SELECT Pid FROM pslist() WHERE Name =~ '(java|httpd|apache)'))
  AND Name =~ '(sh|bash|python|perl|curl|wget|nc|ncat)'

-- 2) Recently created script files in web/upload/tmp directories (last 14 days)
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['/opt/*/web/**/*.jsp', '/opt/*/webapps/**/*.jsp',
                 '/var/log/**/uploads/**/*.sh', '/tmp/*.sh', '/tmp/*.py',
                 '/var/tmp/*.sh', '/var/tmp/*.py',
                 '/web/htdocs/**/*.php', '/web/htdocs/**/*.jsp'])
WHERE Mtime > now() - 1209600
ORDER BY Mtime DESC

-- 3) Established outbound connections from the management server (C2 beaconing)
SELECT Pid, Name, Laddr, Lport, Raddr, Rport, Status
FROM netstat()
WHERE Status =~ 'ESTABLISHED'
  AND NOT Raddr =~ '^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.|127\\.)'

#!/bin/bash
# CVE-2026-93616 — Gaia management server triage & hardening verification
# Run via expert mode on SMS / MDS / Log Server / SmartEvent. Read-only checks; review before executing any remediation lines.

echo "=== [1] Confirm installed Jumbo Hotfix / version (verify against Check Point advisory for CVE-2026-93616) ==="
clish -c "show installer status" 2>/dev/null || cpinfo -y all 2>/dev/null

echo "=== [2] Scan web-served and temp directories for recently modified script files (last 14 days) ==="
find /opt /web /var/log -type f \( -name "*.jsp" -o -name "*.jspx" -o -name "*.php" -o -name "*.war" \) -mtime -14 -ls 2>/dev/null | head -100
find /tmp /var/tmp -type f \( -name "*.sh" -o -name "*.py" -o -name "*.pl" \) -mtime -14 -ls 2>/dev/null | head -100

echo "=== [3] Grep management web access logs for traversal sequences ==="
grep -REl '(\.\./|\.\.%2f|%2e%2e|%252e%252e|\.\.;/)' /opt/*/web/logs/ /var/log/httpd* /var/log/apache* 2>/dev/null | while read -r f; do
  echo "--- $f ---"; grep -E '(\.\./|\.\.%2f|%2e%2e|%252e%252e|\.\.;/)' "$f" | tail -20
done

echo "=== [4] Child processes of web stack (live check) ==="
for pid in $(pgrep -f 'java|httpd'); do ps --ppid "$pid" -o pid,ppid,user,comm,args 2>/dev/null; done | grep -E 'sh|bash|python|perl|curl|wget|nc' || echo "No suspicious children found."

echo "=== [5] Outbound established connections (C2 check) ==="
ss -tnp state established | grep -vE '10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.' || echo "No external established sessions."

echo "=== [6] Verify management interface is NOT internet-reachable (check NAT/ACL on upstream firewall separately) ==="
clish -c "show configuration interface" 2>/dev/null | grep -A2 -i 'management\|eth0'

echo "DONE — preserve all output and logs to forensic storage BEFORE patching, per CISA Forensics Triage Requirements."