A stack-based buffer overflow in Check Point’s Security Management Server login process allows an unauthenticated attacker to execute code as root on the machine that controls every firewall, policy, and rule across an enterprise Check Point deployment.
CVE-2026-91843 carries a CVSS score of 9.8 out of 10. The overflow is triggered by a login request that carries an excessively long username, occurring before authentication completes. No credentials are needed. No user interaction is required. Attack complexity is low.
The Vulnerability
The flaw sits in the login process of the Security Management Server, the system that administers Security Gateways, enforces firewall policy, and monitors network security events. A successful exploit grants root-level access to the management server itself. An attacker who owns the management server owns the entire estate – every gateway, every policy, every rule.
The affected version range is broad. R82.20 with all builds is vulnerable, with no Jumbo Hotfix yet protecting that branch. Below R82.20, the vulnerability extends through R82.10 (Take 44 or below), R82 (Take 126 or below), R81.20 (Take 166 or below), R81.10 (Take 190 or below), and legacy branches R81 through R80, all of which are end-of-support. NHS England Digital confirmed that Smart-1 Cloud, the hosted service, is not affected because the fix is already in place server-side.
Check Point released a LivePatch via advisory sk1000155 on September 16. Customers with automatic updates enabled per sk175504 are already protected. Aviv Abramovich, VP of product management for network security at Check Point, told The Hacker News that the vulnerable path runs only through the Trusted Clients setting and that fixes for end-of-support versions are available via support ticket. For organizations unable to patch immediately, the primary mitigation is to restrict Trusted Clients to known administrative IP addresses and ensure management interfaces are not exposed directly to the internet.
Detection is straightforward. BleepingComputer reports that exploitation attempts surface in Audit and Admin login logs as “Administrator failed to log in: Username too long.” As of the disclosure date, CISA recorded exploitation as “none”. No public proof-of-concept exploit existed as of September 16.
Fifth Flaw in Two Months
CVE-2026-91843 is the fifth critical management-plane vulnerability in Check Point infrastructure since July 2026. The Hacker News count of Check Point CVE records shows five flaws an attacker could reach on the Security Management Server without logging in, in under eight weeks:
- CVE-2026-16232 (July) – SmartConsole authentication bypass. Exploited in the wild. Added to CISA KEV the same day. Affected management exposed to the internet without IP restrictions.
- CVE-2026-62144 (July) – Second management bypass disclosed the same day. Not reported as exploited.
- CVE-2026-18574 (August 3) – Authentication bypass allowing command execution on the management server. Found internally, no exploitation indication.
- CVE-2026-85103 (September 9) – Heap overflow in VPN certificate ASN.1 decoding that reaches Quantum Security Management. Found internally. “All Security Management Server deployments are vulnerable, regardless of configuration,” Check Point warned.
- CVE-2026-91843 (September 16) – Stack overflow in login process. The current disclosure.
Censys observes 3,836 hosts worldwide presenting the default identity Check Point gives its management and log servers. The company notes this figure represents total role presence, not a confirmed-vulnerable count. But the number is not small.
The Management Plane as Attack Surface
The management server is not the firewall. It is the system that tells every firewall what to do. An attacker who compromises it does not need to break into individual gateways – they control the policy layer that governs all of them. This makes management-plane RCE a distinct risk class from data-plane or identity-plane CVEs. The blast radius is not one server. It is the entire fleet.
Five critical management-plane flaws in under eight weeks is not a normal rate. The pattern suggests structural issues in how the management layer handles unauthenticated input – the login process, the certificate parser, the authentication flow. Each flaw is different in its technical root cause, but they converge on the same surface: the management server’s exposed interfaces.
This mirrors the pattern our prior coverage has tracked across other vendors. The Cisco ISE nine-CVE disclosure showed identity infrastructure becoming the attack surface itself. Delinea Secret Server exposed privileged access management as a target. The Azure Identity Triple-Crown cracked the identity control plane. Check Point’s management-plane cluster extends the same structural vulnerability into a different layer – the tool that administers the security infrastructure rather than the infrastructure itself.
What to Watch
- Exploitation telemetry: CVE-2026-16232 was exploited within days of its July disclosure. Whether CVE-2026-91843 follows the same trajectory depends on whether weaponization outpaces LivePatch adoption.
- Trusted Clients enforcement: Abramovich confirmed the vulnerable path runs only through Trusted Clients. The Check Point hardening guide recommends Trusted Clients never be set to “any IP address.” How many deployments actually enforce this is the open question.
- Dutch NCSC-NL warning: The Dutch National Cyber Security Centre warned organizations to prioritize patching two earlier Check Point VPN flaws because it “expects exploitation attempts to occur soon.” The management-plane cluster may follow the same trajectory.
- R82.20 gap: Every R82.20 build is affected and no Jumbo Hotfix yet protects that branch. Organizations on R82.20 must rely on LivePatch or Trusted Clients restrictions until a hotfix arrives.