CVE-2026-91843

CVE Enrichment

CVSS: 9.8 CRITICAL
EPSS: 0.52%
EPSS Percentile: 42.83%
CISA KEV: Not listed

Description

A stack overflow during the unauthenticated login process may allow an attacker to run arbitrary code remotely with root privileges.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: cve@checkpoint.com
Published: 16-Sep-2026 21:17
Last Modified: 19-Sep-2026 02:34
EPSS Date: 2026-10-16
CWE: CWE-121

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

References

cve@checkpoint.com

Last enrichment sync: 17-Oct-2026 11:52
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (3)

A third vulnerability, CVE-2026-91843, is a a vulnerability in the unauthenticated login process that can allow attackers to execute code as root on several Check Point management and logging servers. InfraTrust Report Finds Exploited Flaws in Infrastructure Management Systems
On September 16, Check Point fixed a separate flaw in the management server, CVE-2026-91843, through LivePatch. Check Point Reports Targeted Attacks on Management Server Zero-Day and Attempts Against VPN Flaw
Check Point Software has issued security updates for CVE-2026-91843, a critical stack-based buffer overflow flaw that can allow unauthenticated attackers to achieve root remote code execution on Security Management Check Point Patches Critical Flaw Enabling Root Code Execution on Management Servers

CVE (14)

Malware (2)

People (1)

Threat Actors (5)

MITRE ATT&CK (6)

Vendors (7)

Products (15)

Tools (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.