Check Point Patches Critical RCE Flaw (CVE-2026-91843)

Executive Summary

Check Point has released a patch for a critical vulnerability, CVE-2026-91843, in its Security Management and Log Server products. The flaw is a stack-based buffer overflow with a CVSS score of 9.8, enabling an unauthenticated, remote attacker to execute arbitrary code with root privileges. The vulnerability can be triggered by sending a login request with an excessively long username to the management server's SmartConsole port. While Check Point has not observed active exploitation, the simplicity of the attack vector presents a significant risk. The company has deployed a fix through its automatic LivePatch update service and recommends administrators ensure the patch is applied and, as a best practice, restrict the list of Trusted Clients that can access the management interface.

Vulnerability Details

The vulnerability is a pre-authentication, stack-based buffer overflow within the login process of the Check Point Security Management and Log Server. An attacker can trigger this by sending a crafted login request containing a very long username string. This action overflows a buffer on the stack, potentially allowing the attacker to overwrite critical control structures and achieve arbitrary code execution.

• CVE ID: CVE-2026-91843
• CVSS Score: 9.8 (Critical)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None

Because the flaw is in the login process, an attacker does not need valid credentials to exploit it. A successful exploit grants the attacker root access, the highest level of privilege on the system, giving them complete control over the central nervous system of an organization's Check Point security infrastructure.

Affected Systems

The vulnerability affects a wide range of Check Point products:

• Check Point Security Management Server: Versions R82.20, R82.10, R82, R81.20, R81.10, and older.
• Check Point Log Server: All versions.

The attack path is exposed through the server's Trusted Clients setting, which dictates which hosts can connect via the SmartConsole management application.

Exploitation Status

As of the disclosure, Check Point has stated there is no evidence of CVE-2026-91843 being exploited in the wild. However, given the low complexity and high impact of the vulnerability, security researchers and threat actors are likely to develop proof-of-concept exploits quickly. This is the fifth critical, unauthenticated vulnerability discovered in Check Point's management server since July 2026, highlighting a concerning trend for the product.

Impact Assessment

Compromising a Check Point Security Management Server is a catastrophic event. As the central point for policy management, logging, and administration, an attacker with root access can:

• Modify or delete firewall rules to allow malicious traffic and exfiltrate data.
• Create rogue administrator accounts for persistent access.
• Disable logging or manipulate logs to conceal malicious activity.
• Access sensitive configuration data, including credentials and network topology information.
• Use the management server as a highly trusted pivot point to attack other systems within the network.

Cyber Observables — Hunting Hints

The following patterns may help identify vulnerable or compromised systems:

• Audit Logs: Check Point has advised administrators to search for the following alert message in audit and admin logs, which may indicate an exploitation attempt:

  Administrator failed to log in: Username too long
  

• Network Traffic: Monitor network traffic to the SmartConsole port (typically TCP/19009) for connections from untrusted IP addresses or for login packets containing unusually large username fields.
• Process Monitoring: On the management server, monitor for unexpected processes being spawned by the main management service process, especially those running as root.

Detection Methods

• Log Analysis: Configure SIEM alerts to trigger on the "Username too long" log message. Correlate this with the source IP to identify potential attackers. This is a form of D3-LAM: Local Account Monitoring.
• Vulnerability Scanning: Use vulnerability scanners with updated plugins to detect unpatched Check Point Security Management and Log Servers in your environment.
• Network Intrusion Detection/Prevention Systems (IDS/IPS): Deploy signatures that detect abnormally long username strings in login requests to the Check Point management port. This falls under D3-ITF: Inbound Traffic Filtering.

Remediation Steps

1. Apply the Patch: The primary remediation is to ensure the hotfix provided by Check Point has been applied. For customers with the automatic LivePatch feature enabled, this should have occurred automatically. Manually verify the patch installation via the advisory sk1000155.
2. Restrict Access: As a critical security best practice, strictly limit the Trusted Clients setting on the Security Management Server. This list should only contain the IP addresses of dedicated and secured administrator workstations or jump boxes. This reduces the attack surface available to potential attackers.
3. Network Segmentation: Ensure the management interface of the Check Point server is on a segregated management network, isolated from general user and server networks.
4. Monitor for IOCs: Proactively hunt for the "Username too long" log entry to determine if any exploitation attempts have occurred.