CVE-2026-91843: Check Point Root RCE

Check Point has patched CVE-2026-91843, a critical stack-based buffer overflow flaw in the login process of its Security Management and Log Server products. If exploited, an unauthenticated remote attacker could execute arbitrary code with root privileges.

Because this flaw impacts systems that manage firewall policies, administrator access, and security event logging, it poses a significant operational risk. Although Check Point reports no known exploitation in the wild, organizations are strongly advised to apply the available LivePatch immediately.

What Is CVE-2026-91843?

CVE-2026-91843 (CVSS 9.8) is a stack-based buffer overflow (tracked as CWE-121) that resides in the pre-authentication login handler used across affected Check Point management and logging solutions.

The vulnerability stems from how login data is processed prior to authentication. An attacker can send a specially crafted request containing an oversized username to trigger the overflow, potentially achieving remote code execution as root without requiring valid credentials or user interaction. Since these servers serve as the core administrative hub, controlling network access rules and storing security logs, a root-level compromise gives attackers full control over security configurations and internal data.

Check Point has not publicly disclosed the exact vulnerable function, memory structures, or detailed exploit chains.

Which Check Point Versions Are Affected?

The flaw impacts deployments of Security Management Server, Multi-Domain Security Management Server, Log Server, and Multi-Domain Log Server. Check Point confirmed that standalone installations operating in a management role are also vulnerable.

The following releases are affected:

Check Point provides patches via LivePatch. The latest LivePatch packages are Take 29 for R82.20 and Take 28 for R82.10, R82, and R81.20. Note that these LivePatch iteration numbers are separate from the Jumbo Hotfix Take levels listed above.

Organizations with automatic updates enabled may already have received the fix, but security administrators should verify LivePatch status manually. Customers on End-of-Support versions can contact Check Point Support to request a patch package.

Smart-1 Cloud environments are unaffected, as Check Point deployed the mitigation across hosted instances prior to public disclosure.

How Could CVE-2026-91843 Be Exploited?

Check Point indicated that the vulnerable code path is reached via the Trusted Clients interface, which defines which hosts and networks are permitted to connect to the management server using SmartConsole.

This makes Trusted Clients configuration an important exposure factor. Systems configured to accept connections from broadly defined networks, particularly Any, have a wider attack surface than environments restricted to specific administrative IP addresses or subnets.

According to Censys, approximately 3,836 internet-facing hosts present a Check Point management or log-server identity. While this count reflects overall role presence on the public internet rather than confirmed vulnerable systems, it highlights significant exposure across several critical risk factors:

• Direct Internet Reachability: Management interfaces exposed directly to the public web are significantly easier targets for scanning and remote exploitation attempts.
• Permissive Trusted Clients Access: Servers configured with overly broad access rules (such as accepting connections from Any) expand the pool of potential origin IP addresses capable of reaching the pre-authentication login handler.
• Patch Verification on Isolated Networks: Deployments in segmented or restricted network zones may fail to automatically fetch or apply the LivePatch, requiring manual confirmation from administrators.

While tightening Trusted Clients rules reduces attack surface, it should be viewed as defense-in-depth rather than a replacement for patching. Priority should be given to internet-accessible management servers and deployments with overly permissive client rules.

Is There Active Exploitation?

As of September 18, 2026, there is no evidence indicating active exploitation of CVE-2026-91843, and Check Point has confirmed no reported incidents in the wild.

Through real-time Vulnerability Intelligence, SOCRadar’s Cyber Threat Intelligence (CTI) module delivers actionable insights by monitoring emerging exploits, PoC releases, Dark Web discussions, and threat actor operations across global sources. Concurrently, the Attack Surface Management (ASM) module continuously scans external digital assets, automatically detecting misconfigurations and vulnerable software deployments to enable security teams to effectively prioritize critical security risks before exploitation occurs.

What Should Defenders Do Right Now?

Apply and Verify the LivePatch

Review Check Point advisory sk1000155 and apply the latest LivePatch across all self-managed installations. Even if automatic updates are enabled, manually confirm that the live patch applied successfully.

If running End-of-Support releases, reach out to Check Point Support for temporary remediation options and plan a migration path to a supported version.

Restrict Trusted Clients

Restrict Trusted Clients settings strictly to explicit administrator IP addresses or isolated management subnets. Avoid using Any, and isolate management interfaces behind perimeter security to prevent public internet access.

Note that network restrictions serve as secondary protections and should not replace applying official security patches.

Hunt for Suspicious Login Activity

Check Point advises security teams to monitor SmartConsole Audit and Admin login logs for the following warning pattern:

Administrator failed to log in: Username too long

This entry indicates an attempt to supply an oversized username to the authentication service.

Additionally, investigate suspicious indicators such as multiple failed login attempts, requests originating from unexpected IP addresses, administrative actions outside normal operational hours, and unauthorized updates to policy rules, administrator accounts, or Trusted Clients definitions.

Presence of this log event marks a trigger attempt rather than confirmed compromise. Always preserve audit logs and correlate events against endpoint telemetry, network monitoring, and source IP context.