Check Point Fixes Critical CVE-2026-91843 Allowing Root Code Execution
Check Point patched CVE-2026-91843 (CVSS 9.8), a pre-authentication root RCE in Security Management and Log Servers; no exploitation observed.
Check Point fixed CVE-2026-91843 (CVSS 9.8), an unauthenticated stack overflow in the Security Management and Log Server login process that enables remote code execution as root. The attack path requires the Trusted Clients setting governing SmartConsole access and affects versions from R80 through R82.20 below listed hotfix takes. The fix ships via LivePatch under advisory sk1000155; Censys observed 3,836 hosts with the management role and no public PoC as of September 16.
- Stack overflow triggered by an extremely long username sent to the pre-authentication login process.
- Attack path requires the Trusted Clients setting controlling SmartConsole access to the management server.
- Affected versions span R80 through R82.20, including multiple end-of-support releases.
- Fix delivered via LivePatch (advisory sk1000155); auto-update customers are already protected.
- Censys counted 3,836 hosts with the management/log server role; no exploitation or PoC seen.
- CVEs
- CVE-2026-91843
- Vendors
- Check PointCensys
- Organizations
- Check PointCensys
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-91843 | Unauthenticated stack overflow gives root RCE in Check Point login process | 9.8 | <1% | PoC |
From the original article
2 min read at securityaffairs.com
Check Point fixed CVE-2026-91843, a critical flaw that could let attackers run code as root on Security Management and Log Servers with no login needed. Check Point addressed CVE-2026-91843 (CVSS score of 9. 8), a critical vulnerability in its Security Management and Log Servers.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.