Critical Check Point Flaw Allows Unauthenticated Root Code Execution
A critical security vulnerability in Check Point Security Management and Log Servers could allow an unauthenticated attacker to remotely execute arbitrary code with root privileges.
The vulnerability, tracked as CVE-2026-91843, has been rated 9.8 out of 10 (Critical) on the CVSS scale by Check Point.
Check Point has released a security fix through its LivePatch update channel. The company said it currently has no evidence that the vulnerability has been exploited in the wild.
Vulnerability Details
CVE-2026-91843 is a stack-based buffer overflow in the login process of Check Point's management infrastructure.
According to Check Point, the vulnerable code path is associated with the Trusted Clients configuration, which controls which hosts are allowed to connect to the Security Management Server through SmartConsole.
Security researchers at Censys reported that the vulnerability can be triggered through a login request containing an excessively long username.
Because the vulnerable processing occurs before authentication, a remote attacker does not need valid login credentials to potentially exploit the flaw.
Successful exploitation could allow an attacker to execute arbitrary operating system commands with root-level privileges on an affected server.
Affected Check Point Products
The vulnerability affects several Check Point Security Management and Log Server deployments.
Affected branches include:
- R82.10: Jumbo Hotfix Take 44 or below
- R82: Jumbo Hotfix Take 126 or below
- R81.20: Jumbo Hotfix Take 166 or below
- R81.10: Jumbo Hotfix Take 190 or below
- Older versions including R81, R80.40, R80.30, R80.20, R80.10 and R80 are also affected and are end-of-support.
Check Point also confirmed that R82.20 is vulnerable, although the CVE record does not currently list that branch. Censys reported that all R82.20 builds were affected at the time of its advisory and that no Jumbo Hotfix was available for that branch at that point.
Standalone deployments, where the management server and gateway operate on the same system, as well as Log Servers and Multi-Domain Servers, are also affected.
The hosted Smart-1 Cloud service is not affected because the required fix has already been deployed.
Check Point Releases LivePatch Fix
Check Point released a security fix through its LivePatch update channel.
Customers with automatic security updates enabled may already have received the protection, but Check Point recommends confirming that the LivePatch has actually been installed.
Administrators can use the following command to check installed LivePatches and their status:
cplp list
Customers running older, end-of-support versions should contact Check Point Support to obtain the appropriate fix.
No Evidence of Active Exploitation
Check Point said it currently has no indication that CVE-2026-91843 has been exploited in the wild.
CISA also recorded exploitation as "none" in its assessment of the CVE record on September 17, 2026.
The vulnerability was not listed in CISA's Known Exploited Vulnerabilities catalog as of its September 16 release, and Censys reported that there was no publicly available proof-of-concept exploit as of September 16.
However, the critical severity and the possibility of unauthenticated remote code execution make the vulnerability particularly important for organizations running exposed Check Point management infrastructure.
What Administrators Should Do
Organizations using affected Check Point products should take the following steps:
- Apply the LivePatch security update described in Check Point advisory sk1000155.
- If automatic updates are enabled, verify that the LivePatch has actually been installed.
- Check the Trusted Clients configuration and ensure that only known and trusted hosts are allowed.
- Do not configure Trusted Clients to allow access from any IP address.
- Avoid exposing Check Point management interfaces directly to the public internet.
- Use a VPN or another controlled access mechanism for management connectivity.
- Review authentication and management logs for unusual connection attempts.
- For end-of-support versions, contact Check Point Support for the available security fix.
Internet Exposure
Censys reported observing approximately 3,836 hosts worldwide presenting the default identity associated with Check Point management and log servers.
Censys emphasized that this number represents the presence of Check Point management or log-server roles and does not mean that all of these systems are vulnerable.
The exact software build and installed hotfix level cannot be reliably determined from the public scan data alone.
Fifth Critical Check Point Management Flaw Since July
CVE-2026-91843 is the fifth critical vulnerability affecting Check Point Security Management Server since July 2026 that could potentially be reached without authentication.
Earlier vulnerabilities included:
- CVE-2026-16232 — SmartConsole authentication bypass that was exploited in July 2026.
- CVE-2026-62144 — Another management authentication bypass disclosed in July.
- CVE-2026-18574 — Authentication bypass that could potentially lead to command execution.
- CVE-2026-85103 — Heap overflow affecting VPN certificate processing and Quantum Security Management.
Check Point previously reported exploitation of CVE-2026-16232 and said the issue affected a limited number of customers under a specific configuration where management access was exposed directly to the internet without IP restrictions.
Conclusion
CVE-2026-91843 represents a serious security risk for organizations operating vulnerable Check Point Security Management or Log Server systems.
Although there is currently no reported evidence of exploitation, the vulnerability has a CVSS score of 9.8 and could potentially provide unauthenticated attackers with remote code execution and root-level access.
Organizations should verify their affected versions, review Trusted Clients settings, and apply the available LivePatch security update as soon as possible.
Vulnerability: CVE-2026-91843
Severity: Critical
CVSS: 9.8
Impact: Unauthenticated Remote Code Execution
Privilege: Root
Affected Vendor: Check Point
Fix: Check Point LivePatch
Status: No confirmed exploitation reported by Check Point
