{"id":"CVE-2026-93616","kind":"vulnerability","aliases":["CVE-2026-93616"],"related":[],"title":"A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute…","description":"WAF Release - 2026-07-17 - Emergency · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nJuly 17, 2026\n\n## WAF Release - 2026-07-17 - Emergency\n\nThis emergency release adds a new managed rule to block active exploitation of a critical remote code execution (RCE) and SQL injection (SQLi) vulnerability found in popular web frameworks.\n\nKey Findings\n\n- Generic Frameworks - Unauthenticated RCE: Attackers can execute arbitrary system commands with web server privileges by sending malicious input containing invalid path sequences during request processing.\n- Generic Frameworks - SQLi: Attackers can execute unauthorized database queries due to a failure to sanitize input values within request parameters.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...550664b6 | N/A | Generic Rules - Unauthenticated RCE | N/A | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...ed933fcc | N/A | Generic Rules - SQLi | N/A | Block | This is a new detection. |\n| Cloudflare Free Ruleset | ...b5ec246a | N/A | Generic Rules - Unauthenticated RCE | N/A | Block | This is a new detection. |\n| Cloudflare Free Ruleset | ...33697a1a | N/A | Generic Rules - SQLi | N/A | Block | This is a new detection. |","summary":"Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal flaw that lets an unauthenticated attacker upload and execute arbitrary scripts. Attackers are already exploiting it in the wild, according to CISA's KEV catalog.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2026-09-22T00:00:00+00:00","products":[{"name":"Check Point Multiple Products","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"checkpoint multi-domain security management","fixed":["r81.10"],"affected":">= r80, < r81.10","ecosystem":"vendor"},{"name":"checkpoint multi-domain security management","fixed":[],"affected":"= r81.10","ecosystem":"vendor"},{"name":"checkpoint multi-domain security management","fixed":[],"affected":"= r81.20","ecosystem":"vendor"},{"name":"checkpoint multi-domain security management","fixed":[],"affected":"= r82","ecosystem":"vendor"},{"name":"checkpoint multi-domain security management","fixed":[],"affected":"= r82.10","ecosystem":"vendor"},{"name":"checkpoint multi-domain security management","fixed":[],"affected":"= r82.20","ecosystem":"vendor"},{"name":"checkpoint quantum security management","fixed":["r81.10"],"affected":">= r80, < r81.10","ecosystem":"vendor"},{"name":"checkpoint quantum security management","fixed":[],"affected":"= r81.10","ecosystem":"vendor"},{"name":"checkpoint quantum security management","fixed":[],"affected":"= r81.20","ecosystem":"vendor"},{"name":"checkpoint quantum security management","fixed":[],"affected":"= r82","ecosystem":"vendor"},{"name":"checkpoint quantum security management","fixed":[],"affected":"= r82.10","ecosystem":"vendor"},{"name":"checkpoint quantum security management","fixed":[],"affected":"= r82.20","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["check-point","cloudflare","exploited","lab-disclosure","security-management","self-hosted","smartevent","vendor"],"not_affected_if":["no-check-point-management-server"],"how_to_check":"Check the Check Point management and log server versions against the vendor advisory; the sources do not give affected or fixed versions.\nReview management server logs and file system for unexpected uploaded scripts.","fix":"Apply the vendor mitigation or patch per Check Point's advisory and CISA BOD 26-04 guidance; if no mitigation exists, discontinue use of the product as CISA directs.","status":"open","published_at":"2026-07-17T18:42:28+00:00","first_seen_at":"2026-10-23T19:11:50+00:00","triaged_at":"2026-10-23T20:29:45+00:00","updated_at":"2026-10-24T18:43:45+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-10-23T20:29:45Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation or patch per Check Point's advisory and CISA BOD 26-04 guidance; if no mitigation exists, discontinue use of the product as CISA directs.\nunknown","summary":"Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal flaw that lets an unauthenticated attacker upload and execute arbitrary scripts. Attackers are already exploiting it in the wild, according to CISA's KEV catalog.","category":"vendor","who_cares":["check-point","self-hosted","security-management","smartevent"],"confidence":0.8,"analyst_note":"Find affected and fixed versions and the vendor mitigation in the Check Point advisory for CVE-2026-93616; the KEV entry does not give them.","how_to_check":"Check the Check Point management and log server versions against the vendor advisory; the sources do not give affected or fixed versions.\nReview management server logs and file system for unexpected uploaded scripts.\nunknown","needs_analyst":true,"not_affected_if":["no-check-point-management-server"],"severity_if_unknown":"critical"},"cost_usd":0.000431,"input_tokens":2232,"output_tokens":415,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-07':154C,171C '-17':155C,172C '-2026':17A,20A '-93616':18A,21A '17':166C '2026':153C,167C,170C '33697a1a':312C '550664b6':265C 'accord':145B 'action':258C,260C 'activ':184C 'add':177C 'allow':8A 'alreadi':139B 'arbitrari':135B,212C 'attack':11A,131B,137B,209C,233C 'b5ec246a':296C 'block':183C,272C,287C,303C,318C 'catalog':150B 'changelog':157C,158C 'check':22A,87B,102B 'check-point':86B 'checkpoint':26A,32A,38A,44A,50A,56A,62A,66A,70A,74A,78A,82A 'cisa':147B 'cloudflar':89B,164C,262C,278C,293C,309C 'code':190C 'command':214C 'comment':261C 'contain':122B,223C 'critic':188C 'cve':16A,19A 'databas':237C 'descript':256C 'detect':277C,292C,308C,323C 'directori':2A 'disclosur':93B 'domain':29A,35A,41A,47A,53A,59A,109B,117B 'due':239C 'ed933fcc':281C 'emerg':156C,173C,175C 'execut':15A,134B,191C,211C,235C 'exploit':90B,140B,185C 'failur':242C 'file':5A 'find':204C 'flaw':126B 'found':198C 'framework':202C,206C,231C 'free':294C,310C 'generic':205C,230C,267C,283C,298C,314C 'host':99B 'id':252C,255C 'improv':162C 'inject':195C 'input':222C,245C 'invalid':224C 'juli':165C 'kev':149B 'key':203C 'lab':92B 'lab-disclosur':91B 'legaci':253C 'let':128B 'log':113B,118B 'malici':221C 'manag':96B,105B,111B,180C,263C,279C 'management':31A,37A,43A,49A,55A,61A,65A,69A,73A,77A,81A,85A 'multi':28A,34A,40A,46A,52A,58A,108B,116B 'multi-domain':27A,33A,39A,45A,51A,57A,107B,115B 'multiple':24A 'n/a':266C,271C,282C,286C,297C,302C,313C,317C 'new':159C,179C,259C,276C,291C,307C,322C 'paramet':249C 'path':124B,225C 'point':23A,88B,103B 'popular':200C 'previous':257C 'privileg':218C 'process':229C 'products':25A 'quantum':63A,67A,71A,75A,79A,83A 'queri':238C 'rce':192C,208C,270C,301C 'releas':152C,169C,176C 'remot':189C 'request':228C,248C 'rule':181C,251C,254C,268C,284C,299C,315C 'ruleset':250C,264C,280C,295C,311C 'sanit':244C 'script':136B 'secur':95B,104B,110B 'security':30A,36A,42A,48A,54A,60A,64A,68A,72A,76A,80A,84A 'security-manag':94B 'self':98B 'self-host':97B 'send':220C 'sequenc':226C 'server':106B,112B,114B,119B,217C 'smartev':100B,121B 'sql':194C 'sqli':196C,232C,285C,316C 'system':213C 'travers':3A,125B 'unauthent':10A,130B,207C,269C,300C 'unauthor':236C 'updat':160C 'upload':6A,13A,132B 'valu':246C 'vendor':101B 'vulner':7A,197C 'waf':151C,168C 'web':201C,216C 'wild':144B 'within':247C","nicknames":[],"mitigations":[{"kind":"waf-rule","scope":null,"since":"2026-07-17","covers":"HTTP requests proxied through Cloudflare, blocked by the Cloudflare Managed Ruleset rule 'Generic Rules - Unauthenticated RCE' and the Cloudflare Free Ruleset rule of the same name, which target invalid path sequences in request processing","limits":"The document does not name CVE-2026-93616 and does not state coverage for non-HTTP paths or traffic that bypasses Cloudflare; none stated otherwise.","source":"https://developers.cloudflare.com/changelog/post/2026-07-17-emergency-waf-release/","vendor":"Cloudflare","seen_at":"2026-10-24T18:42:37Z","confidence":0.6,"source_title":"WAF Release - 2026-07-17 - Emergency · Changelog","customer_action":"Keep the Cloudflare Managed or Free ruleset enabled; the document does not say the rule replaces patching the vulnerable framework."}],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-07-17T18:42:28+00:00","kev":{"dateAdded":"2026-09-22","dueDate":"2026-09-25","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"cve@checkpoint.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-93616","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-93616","severity":null,"published_at":"2026-09-22T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:50+00:00","fetched_at":"2026-10-25T11:39:13+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-93616","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93616","severity":null,"published_at":"2026-09-22T13:17:11+00:00","modified_at":"2026-09-23T16:38:38+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null},{"source":"lab","external_id":"https://developers.cloudflare.com/changelog/post/2026-07-17-emergency-waf-release/#CVE-2026-93616","url":"https://developers.cloudflare.com/changelog/post/2026-07-17-emergency-waf-release/","severity":null,"published_at":"2026-07-17T18:42:28+00:00","modified_at":null,"first_seen_at":"2026-10-24T18:43:45+00:00","fetched_at":"2026-10-24T18:43:45+00:00","note":"Cloudflare: WAF Release - 2026-07-17 - Emergency · Changelog"}],"documents":[{"id":2877,"url":"https://developers.cloudflare.com/changelog/post/2026-07-17-emergency-waf-release/","title":"Cloudflare: WAF Release - 2026-07-17 - Emergency · Changelog","kind":"advisory","source":"lab","text":"WAF Release - 2026-07-17 - Emergency · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nJuly 17, 2026\n\n## WAF Release - 2026-07-17 - Emergency\n\nThis emergency release adds a new managed rule to block active exploitation of a critical remote code execution (RCE) and SQL injection (SQLi) vulnerability found in popular web frameworks.\n\nKey Findings\n\n- Generic Frameworks - Unauthenticated RCE: Attackers can execute arbitrary system commands with web server privileges by sending malicious input containing invalid path sequences during request processing.\n- Generic Frameworks - SQLi: Attackers can execute unauthorized database queries due to a failure to sanitize input values within request parameters.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...550664b6 | N/A | Generic Rules - Unauthenticated RCE | N/A | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...ed933fcc | N/A | Generic Rules - SQLi | N/A | Block | This is a new detection. |\n| Cloudflare Free Ruleset | ...b5ec246a | N/A | Generic Rules - Unauthenticated RCE | N/A | Block | This is a new detection. |\n| Cloudflare Free Ruleset | ...33697a1a | N/A | Generic Rules - SQLi | N/A | Block | This is a new detection. |","published_at":"2026-07-17T18:42:28+00:00","relation":"advisory","confidence":null,"note":"Cloudflare disclosure page (matched by content)"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}