CISA Cybersecurity Directives & Advisories Brief

Headline

CISA adds unauthenticated remote-code-execution flaw in Check Point security infrastructure to mandatory federal patch catalog

Executive Summary

CISA added CVE-2026-93616, a path traversal vulnerability in Check Point Security Management Server and related products, to the Known Exploited Vulnerabilities catalog on September 22, 2026. The flaw allows an unauthenticated attacker to upload and execute arbitrary scripts. Federal agencies face a remediation deadline of September 25, 2026.

Bottom Line

The catalog addition places an active-exploitation finding on Check Point's management and logging infrastructure, closing the discretionary remediation window for all civilian executive branch agencies by September 25, 2026. Federal operators of any affected product carry a dual obligation: apply vendor mitigations and complete forensic triage under CISA's Forensics Triage Requirements, not patching alone. Organizations with internet-exposed management interfaces face the highest-severity exposure profile under the unauthenticated-upload-and-execute attack vector. Cloud-hosted deployments require separate compliance evaluation under BOD 26-04's cloud track, with discontinuation as the required fallback where mitigations are unavailable.

Key Regulatory Signals

• Federal Agencies Face a Three-Day Remediation Window: The catalog addition sets September 25, 2026 as the federal remediation deadline, giving civilian executive branch agencies fewer than 72 hours from the catalog publication date to apply vendor mitigations or discontinue use of the affected products.
• Affected Product Scope Is Broad Across Check Point Infrastructure: The vulnerability covers Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent. Organizations running any of these products carry active exposure under the catalog's active-exploitation finding.
• Unauthenticated Exploitation Raises Severity of Exposure: The vulnerability requires no authentication, meaning an attacker with network access to an affected management interface can upload and execute arbitrary scripts without valid credentials. Organizations with internet-exposed management servers face the highest immediate risk.
• Cloud Deployments Carry Separate Compliance Obligations: CISA's Binding Operational Directive 26-04 guidance specifies distinct remediation requirements for cloud-hosted instances of affected products. Operators of cloud deployments must evaluate those assets against the cloud-specific BOD 26-04 track and discontinue use if mitigations are unavailable.
• Forensic Triage Is a Required Action, Not Optional: CISA's required-action language explicitly references its Forensics Triage Requirements alongside vendor patching instructions. Affected federal operators must conduct forensic triage, not only apply patches, to satisfy the catalog's remediation standard.

Regulatory Delta

- Check Point management-plane products have appeared in CISA's Known Exploited Vulnerabilities catalog before. The 2025 addition of CVE-2024-24919, a similar information-disclosure flaw affecting Check Point infrastructure, established the pattern of treating these systems as high-priority federal remediation targets.

- The three-day federal remediation window is among the shortest BOD 26-04 timelines issued for a network-security vendor vulnerability. That compressed schedule reflects the unauthenticated remote-execution severity of this specific flaw.

- The mandatory forensic triage requirement alongside patching follows CISA's post-compromise posture for management-plane vulnerabilities, consistent with its 2025 guidance on network device integrity verification.

Materiality Classification

HIGH — The catalog addition imposes a binding September 25, 2026 remediation deadline on all civilian executive branch agencies and carries an active-exploitation finding on widely deployed Check Point management infrastructure, requiring immediate patching and forensic triage across the affected federal operator population.

Time Horizon

implementation — 2026-09-25

Intelligence Outlook

Monitor CISA's Known Exploited Vulnerabilities catalog and Check Point's security advisories for updated mitigation guidance or additional affected product entries related to this vulnerability.