Check Point disclosed CVE-2026-93616 on September 22, a path traversal vulnerability in Quantum Security Management scoring 9.8 on CVSS, alongside confirmation that CVE-2026-85102, a pre-authentication remote code execution flaw in the same product line's VPN certificate handling, is under active exploitation. CISA added both to its Known Exploited Vulnerabilities catalog within a week of each other. The EPSS score on the path traversal sits at 2 percent, low relative to its severity rating, which is the gap worth reading: a critical-rated bug the exploitation-prediction models do not yet expect anyone to bother with, sitting on a management console that talks to every gateway an APAC bank has deployed.

The Quantum Security Management console is the administrative layer that pushes policy to Check Point's distributed VPN gateways, so a path traversal there does not compromise one appliance, it compromises whatever the console is trusted to configure. Combine that with a pre-auth RCE already being exploited on the gateway side and a bank running Check Point has two live disclosures on the same product family in the same week, one theoretical and one not. The people who inherit this are the network engineers who scheduled last week's manual hotfix for CVE-2026-85102 and are now told there is a second one. Check Point's public advisory language calls the pair "critical vulnerabilities," which is accurate and also the least informative thing that could be said about a management-plane bug versus a gateway RCE with attackers already in it.

Check Point is the named vendor on both flaws, and Quantum Security Management and the Security Gateway VPN module are the two products implicated, the console patched proactively and the gateway patched after exploitation was already confirmed. That ordering, gateway compromised first and disclosed with an active-exploitation warning, console flaw disclosed a week later before anyone has weaponized it, is the only fact that tells you which one to treat as the emergency.