Standard
Improper Limitation of a Pathname to a Restricted Directory, mapped to the extraction directory traversal.
CISA added CVE-2026-93616, a 9.8-rated Check Point management flaw, to its Known Exploited Vulnerabilities catalog on September 22, 2026. A dev.to write-up says no final patch covers every release yet, so port exposure is the control.
Reality
CISA's Malcolm before v26.06.0 lets an attacker with no account run script in an analyst's session through one crafted link. Four other flaws in the same advisory need a login, and CISA's fix for all five is the September 2026 release.
Reality
ABB's PCM600 IED manager, versions 2.14 and earlier, lets a standard local user take control of the host through a Scheduler Service running as LocalSystem. ABB's remedy is a workaround it says reduces the risk without correcting the underlying flaw.
Reality
Seven CVEs in RadAsyncUpload, RadPersistenceManager and RadDockLayout give unauthenticated code execution up to build 2026.2.519, and Progress says the exploitation is quiet enough to leave standard ASP.NET error logs clean.
Reality
CISA's advisory for its own network traffic analysis suite lists denial of service and arbitrary code execution: unbounded archive extraction, traversal in two layers, and uploads that run PHP as www-data.
Reality