EUVD-2026-84375
GHSA-x5gq-4cxx-rf2r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Management Server endpoint
-
DeliverySend traversal-crafted upload request
-
ExploitWrite script outside upload directory
-
ExecutionInvoke uploaded script
-
ImpactExecute arbitrary code on appliance
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network reachability to the Check Point Management Server's file-upload interface; per the description exploitation is unauthenticated (PR:N) with no user interaction, so a management interface exposed to an attacker-reachable network is the primary prerequisite. The main limiting factor is exposure: Management Servers are typically intended for internal/administrative networks, so real-world risk hinges on whether the affected upload endpoint is reachable by the attacker. Affected software versions are not enumerated in the provided data, so patch-state gating cannot be confirmed from this input. |
| Impact | This carries a vendor-assigned CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and the metric profile is internally consistent with the description: an unauthenticated, network-reachable directory-traversal-plus-file-upload flaw that yields arbitrary script execution maps cleanly to AV:N/AC:L/PR:N/UI:N with full C/I/A impact. The signals that would confirm real-world urgency are ABSENT from the input: no EPSS probability, no CISA KEV entry, no SSVC decision data, and no public POC are provided - so exploitation status must be reported as 'no public exploit identified at time of analysis' rather than active exploitation. The counterweight to those missing signals is the target: Check Point Management Server is a high-value security-management appliance whose compromise implies control over an organization's firewall policy, making it exactly the class of asset that draws targeted exploitation once details surface. Note the source is the vendor itself (cve@checkpoint.com) and the only reference is a Check Point support SK page, so affected-version details and patch specifics are not verifiable from the provided data. Net: treat as high-priority to patch on the strength of unauthenticated pre-auth RCE-equivalent impact on a critical appliance, while explicitly acknowledging that exploitation-likelihood signals (EPSS/KEV/POC) are simply not present in this dataset rather than confirmed low. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted request to the Management Server's exposed web/file-upload endpoint, using directory-traversal sequences to place a script outside the intended upload directory into a location where it will be executed. They then invoke the uploaded script to run arbitrary code on the appliance, gaining control of the central firewall-management plane. No public POC is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Unauthenticated attackers who can reach the file-upload interface of Check Point Management Server can combine directory traversal with a malicious file upload to place and execute arbitrary scripts, resulting in full loss of confidentiality, integrity, and availability on the management server (vendor-assigned CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vulnerability is network-exploitable with no authentication and no user interaction, so the decisive real-world factor is exposure: these servers are normally confined to internal administrative networks, and risk rises sharply if the affected upload endpoint is reachable from an untrusted network. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and affected version ranges are not enumerated in the available data.
RemediationAI
Patch status is not confirmed from the available data: no vendor-released fix version is cited in the provided intelligence, and the only reference is the Check Point advisory at https://support.checkpoint.com/results/sk/sk1000171, which must be checked for the exact patched build and installation procedure before any version can be stated. Until the applicable hotfix is applied, the highest-value compensating control is exposure reduction: block the management server's upload/management interfaces at the perimeter and restrict them to trusted administrative networks or VPN-only access, since the prerequisite for exploitation is network reachability to the file-upload endpoint; the trade-off is loss of remote administrative convenience and the need to route all admin traffic through the VPN or jump host. Additionally, enforce strict file-type and extension validation and write-permission restrictions on the upload directory so that even a crafted upload cannot land in a script-executable path, though this is a hardening measure rather than a fix and may break legitimate upload workflows if applied too restrictively. Monitoring and alerting on anomalous file writes or unexpected script execution within the management server's web directories is recommended as a detection backstop, and because no public exploit or confirmed in-the-wild activity was identified at time of analysis, prioritization should be driven by whether the upload endpoint is actually internet- or attacker-reachable.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e., path traversal) and manifests through the server's file-upload functionality, which accepts files without adequately constraining the destination path or validating file type and content. By supplying traversal sequences in the upload target, an attacker can escape the intended upload directory and write attacker-controlled script content into a location the web/management service will later execute or serve, converting a file-write primitive into remote code execution. No CPE identifiers or affected version ranges were supplied with the source data, so the precise impacted builds of the Check Point Management Server (including Security Management Server / multi-domain variants) cannot be enumerated from this input; the only vendor artifact provided is the Check Point support advisory at https://support.checkpoint.com/results/sk/sk1000171, which should be treated as the authoritative source for affected versions and product scope. The assessed vector (AV:N/AC:L/PR:N/UI:N, scope unchanged, high C/I/A) is internally consistent with an unauthenticated, network-reachable traversal-plus-upload chain that terminates in arbitrary script execution on the management host.
Know when Checkpoint gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network traversal+upload leading to arbitrary script execution justifies AV:N/AC:L/PR:N/UI:N with full C/I/A on the compromised appliance.
Primary rating from Vendor (checkpoint).
CVSS VectorVendor: checkpoint
Lifecycle Timeline
2DescriptionCVE.org
A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.
Articles & Coverage 1
Technical POC Analysis
Bug class: CWE-22, Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal").
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 public PoC link from nuclei
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
A critical flaw in Check Point Management Server allows anyone who can reach its file-upload interface - without credentials or user interaction - to run their own code on the system, giving an attacker complete control of the platform that governs security policy across the organization. Because these servers are the trust anchor for firewall rulebases, VPN configuration, and security gateways, a compromise could let an adversary silently disable protections, harvest credentials, and pivot into every network segment the management server administers. No patch is currently available, so the exposure window is governed entirely by how tightly the upload interface is shielded from untrusted networks.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict the management server and its file-upload endpoint to trusted administrative networks and administrator-only source IP allowlists; require MFA for all administrative access; block or disable unused web upload functionality; apply WAF/IPS signatures for directory traversal and script-upload patterns; enable detailed upload and file-write logging with alerting; maintain and test offline configuration backups and a compromise-recovery plan.
Threat Model
5 threats: Elevation of Privilege, Tampering, Information Disclosure and 1 more
5-step attack chain with trust boundaries and controls
Full threat model - attack chain, trust boundaries, controls per stage and evidence - is part of the Pro and Business plans.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
More in Checkpoint
View allGNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
Remote code execution in Check Point Quantum Security Gateway arises from improper certificate trust validation during V
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid
Authentication bypass in Check Point Quantum Security Gateway and Spark Firewalls allows unauthenticated remote attacker
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated med
Remote code execution in Check Point Quantum Security Gateway and Quantum Security Management stems from a heap-based bu
Unauthenticated remote code execution affects Check Point Quantum Security Management, where a stack-based buffer overfl
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
Elevated-privilege container restoration in CRI-O 1.34 and later, including downstream Red Hat OpenShift Container Platf
Exploit-DB