Check Point Patches Critical Flaw Enabling Root Code Execution on Management Servers
Summary
Check Point patched CVE-2026-91843, an unauthenticated stack overflow enabling root remote code execution on Security Management Server and Log Server systems, and provided mitigation and detection guidance.
Key points
- CVE-2026-91843 is a stack-based buffer overflow in Check Point login processing.
- Unauthenticated attackers can exploit it for root remote code execution without user interaction.
- Security Management Server and Log Server systems are affected.
- Check Point released security updates and offered temporary mitigations, including restricting access to trusted IP addresses or subnets.
- Defenders can look for “Administrator failed to log in: Username too long” alerts in Audit and Admin login logs.
- Check Point had not flagged CVE-2026-91843 as actively exploited.
- NCSC-NL warned that exploitation attempts against the separately patched CVE-2026-85102 and CVE-2026-85103 may occur soon.
Article Details
- Vulnerability Types
- Stack-based buffer overflow
- Heap overflow
- Authentication bypass
- Severity
- Critical
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- For CVE-2026-91843, harden vulnerable systems and limit access to trusted IP addresses or subnets through the Trusted Clients settings when the latest LivePatch cannot be deployed.
MITRE ATT&CK
T1110 · Brute ForceCVE-2026-85102 is described as enabling unauthenticated attackers to bypass authentication on vulnerable firewalls.T1190 · Exploit Public-Facing ApplicationCVE-2026-91843 can be exploited remotely without authentication to execute code as root on Security Management Server and Log Server systems.
CVE
CVE-2026-16232was abused by a Qilin ransomware affiliate since June, while a second authentication bypass zero-day (CVE-2026-16232) has been exploited since at least July to authenticate with administrator privileges to SmartConsoleCVE-2026-50751The first, an authentication bypass (CVE-2026-50751) zero-day, was abused by a Qilin ransomware affiliate since June, while a second authentication bypass zero-day (CVE-2026-16232) has been exploited since at least JulyCVE-2026-85102The company has also shared mitigation steps and detection guidance, while noting that its recently patched CVE-2026-85102 and CVE-2026-85103 vulnerabilities are considered likely to face exploitation attempts soon.CVE-2026-85103The company has also shared mitigation steps and detection guidance, while noting that its recently patched CVE-2026-85102 and CVE-2026-85103 vulnerabilities are considered likely to face exploitation attempts soon.CVE-2026-91843Check Point Software has issued security updates for CVE-2026-91843, a critical stack-based buffer overflow flaw that can allow unauthenticated attackers to achieve root remote code execution on Security Management
Threat Actors
Malware
Vendors
Products
Log Serverallow unauthenticated attackers to achieve root remote code execution on Security Management Server and Log Server systems.Security Gatewayoverflow weakness in the login process for Security Management Server instances, which manage Security Gateways (firewalls) and monitor network security events.Security Management Serveroverflow flaw that can allow unauthenticated attackers to achieve root remote code execution on Security Management Server and Log Server systems.SmartConsoleby editing the entries under Manage & Settings > Permissions & Administrators > Trusted Clients in the SmartConsole dashboard.