InfraTrust report warns network management systems under attack
Active exploitation of critical Cisco and SonicWall management system vulnerabilities is a major trend, with attackers chaining flaws and deploying ransomware.
90
CVE-2026-91843
Unauthenticated stack overflow gives root RCE in Check Point login process
- CVSS 3.1
- 9.8 critical
- EPSS
- <1%p44
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-91843 is a stack-based buffer overflow (CWE-121) in the unauthenticated login process of a Check Point product, as Check Point Software (cve@checkpoint.com) is the assigning CNA and its CVE scope covers Check Point products. An attacker can trigger the flaw remotely by sending crafted input to the login interface before authenticating, with no user interaction or credentials required. Successful exploitation allows arbitrary code execution with root privileges, the highest level of control on the affected system. The vulnerability is rated 9.8 Critical (AV:N/AC:L/PR:N/UI:N, all impacts high), reflecting trivial network exploitability. No public proof-of-concept or confirmed in-the-wild exploitation is known at this time, and the source data does not name the specific product line or affected version ranges.
What to do: Monitor Check Point's official advisory channels for the affected product/version list and patch release, and upgrade as soon as fixed versions are published. In the interim, restrict the login/management interface of Check Point appliances to trusted management networks and remove any direct internet exposure, and review perimeter logs for anomalous pre-authentication traffic against that interface.
| Product | Affected |
|---|---|
| Check Point | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A stack overflow during the unauthenticated login process may allow an attacker to run arbitrary code remotely with root privileges.
- Weakness
- CWE-121
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news
12 storiesCheck Point Warns of Management Server Zero-Day Exploited in Targeted Attacks
Check Point says attackers exploited unauthenticated Management Server zero-day CVE-2026-93616 in targeted July attacks.
88
Weekly Cybersecurity Newsletter Bulletin – Cisco and Android 0-Day, BragJack Attack, Claude Opus 5 Used to Hack OpenAI, and 20+ Stories
Actively exploited Cisco ISE and Pixel zero-days lead a week of critical flaws, PoCs, and AI-agent attacks.
86
New Check Point flaw lets hackers execute code with root privileges
Check Point patched CVE-2026-91843, a stack-based buffer overflow in Security Management Server logins enabling unauthenticated root remote code execution.
80
CVE-2026-91843: Check Point Root RCE
Check Point patches CVE-2026-91843, a critical unauthenticated root RCE flaw in its Security Management and Log Server login process.
75
Critical Check Point Vulnerability Allows Remote Root Code Execution Without Authentication
Check Point patched CVE-2026-91843 (CVSS 9.8), an unauthenticated stack overflow enabling remote root code execution on Security Management and Log Servers.
72
Check Point Vulnerability Lets Remote Hackers Gain Root Access Without Authentication
Check Point patched CVE-2026-91843, a CVSS 9.8 pre-auth stack overflow granting remote root on Security Management and Log Servers.
70
Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root
Check Point patched CVE-2026-91843 (CVSS 9.8), a pre-authentication stack overflow letting unauthenticated attackers run code as root on Security Management and Log Servers.
66
21st September – Threat Intelligence Report
Check Point weekly roundup covers Japan Digital Agency and Gyazo breaches, actively exploited Cisco ISE flaw, and multiple new APT campaigns.
65
Check Point Fixes Critical CVE-2026-91843 Allowing Root Code Execution
Check Point patched CVE-2026-91843 (CVSS 9.8), a pre-authentication root RCE in Security Management and Log Servers; no exploitation observed.
65
Check Point, Kaspersky, Tanium Patch Product Vulnerabilities
Check Point fixes critical unauthenticated RCE CVE-2026-91843 in Security Management; Tanium and Kaspersky also patch product vulnerabilities.
60
Check Point security advisory (AV26-933)
Canadian Cyber Centre relays Check Point advisory for CVE-2026-91843, a stack overflow in the login process of Security Management and Log Servers.
32