New Check Point flaw lets hackers execute code with root privileges
Check Point patched CVE-2026-91843, a stack-based buffer overflow in Security Management Server logins enabling unauthenticated root remote code execution.
Check Point fixed CVE-2026-91843, a stack-based buffer overflow in the Security Management Server and Log Server login process that allows unauthenticated, low-complexity root RCE without user interaction. All Security Management Server deployments are vulnerable regardless of configuration. Fixes ship via LivePatch, with mitigation limiting SmartConsole Trusted Clients to trusted IPs, and attacks are detectable via 'Administrator failed to log in: Username too long' alerts. The new flaw is not yet flagged as exploited, though Check Point zero-days CVE-2026-50751 and CVE-2026-16232 are actively abused, including by a Qilin ransomware affiliate, and NCSC-NL urged fast patching of CVE-2026-85102 and CVE-2026-85103.
- Stack-based buffer overflow in Security Management Server and Log Server login process.
- Exploitation is low-complexity, needs no privileges or user interaction, and yields root RCE.
- All Security Management Server deployments are vulnerable regardless of configuration.
- Mitigations include LivePatch updates and restricting SmartConsole Trusted Clients to trusted IPs.
- Detect attempts via 'Administrator failed to log in: Username too long' audit alerts.
- Vendors
- Check Point
- Threat actors
- Qilin
- Organizations
- Check PointNCSC-NL
- Countries
- Netherlands
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-16232 | Authentication Bypass in Check Point SmartConsole Grants Full Admin Access | 9.3 | 4% | KEV | KEV |
| CVE-2026-50751 | Unauthenticated IKEv1 VPN Auth Bypass in Check Point Security Gateways | 9.3 | 85% | KEVRansomwarePoC | KEV |
| CVE-2026-85102 | Unauthenticated RCE in Check Point Quantum Security Gateway via certificate flaw | 9.8 | 54% | KEVPoC | KEV |
| CVE-2026-85103 | Unauthenticated RCE in Check Point Quantum VPN Certificate ASN.1 Decoding | 9.8 | — | ||
| CVE-2026-91843 | Unauthenticated stack overflow gives root RCE in Check Point login process | 9.8 | <1% | PoC |
From the original article
2 min read at bleepingcomputer.com
Check Point Software has released security updates to address a critical vulnerability that can let attackers execute code with root privileges on management systems. [...]
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.