Check Point patches unauthenticated root RCE in Security Management and Log Servers

Check Point has shipped fixes for a vulnerability in its Security Management Server and Log Server that lets an attacker with no credentials execute code as root over the network. The flaw is tracked as CVE-2026-91843 and stems from a stack-based buffer overflow in the login process — the code path that runs before authentication succeeds [1][2].

The Security Management Server is the control plane for Check Point deployments: it holds firewall policy, pushes configuration to Security Gateways, and governs administrator access [2]. The Log Server, which collects and stores logs from Check Point firewalls, is affected by the same issue [1]. Root code execution on either system is not a gateway-level compromise in the conventional sense; it is a compromise of the thing that decides what the gateways enforce and of the record of what they saw.

According to NVD data, CVE-2026-91843 carries a CVSS score of 9.8 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low complexity, no privileges, no user interaction. Our computed severity for this item is critical.

Check Point has released the fix through its LivePatch channel and, at the time the reporting was published, had not flagged the flaw as actively exploited [1][2]. Note the tension in the available data: our enrichment feed marks this cluster of Check Point issues as actively exploited, but that reflects two older, separate vulnerabilities in CISA’s KEV catalogue rather than CVE-2026-91843 itself. No source states that CVE-2026-91843 has been exploited in the wild.

Who is affected

Organisations running Check Point Security Management Server or Log Server instances. The sources do not publish a list of affected or fixed version numbers for CVE-2026-91843, so confirm your own build against Check Point’s advisory before concluding you are clear.

The exposure question matters more than usual here. A management server reachable from the internet, with no Trusted Clients restriction, is directly attackable by an unauthenticated party. One that is reachable only from an internal management network is attackable by anything that already has a foothold there.

How it works, as far as the sources say

The overflow is triggered during login. Check Point’s guidance on detection is the clearest public hint at the mechanism: security teams should look for Administrator failed to log in: Username too long entries in the Audit and Admin login logs [1]. That points to an over-long username field being handled unsafely on the stack. No source describes the exploit beyond that, and no public proof-of-concept is mentioned.

The wider context

This is not an isolated Check Point advisory. The week before, Check Point patched CVE-2026-85103, a heap-based buffer overflow in VPN certificate ASN.1 decoding that affects both gateways and management systems. Check Point stated that all Security Management Server deployments are vulnerable regardless of configuration, and that the management server is exposed even where VPN is not in use [1]. The same day it patched CVE-2026-85102, an improper certificate trust validation flaw during VPN negotiation that allows unauthenticated remote code execution on the Gateway. Both are rated 9.8 in NVD.

The Dutch National Cyber Security Centre told organisations to prioritise CVE-2026-85102 and CVE-2026-85103, saying it expects exploitation attempts shortly [1].

Two earlier Check Point authentication bypasses are already confirmed as exploited. CVE-2026-50751, a certificate validation logic flaw in Remote Access and Mobile Access using deprecated IKEv1 key exchange, was abused by a Qilin ransomware affiliate from June; CISA added it to KEV on 8 June 2026 with a 11 June due date and a known ransomware association. CVE-2026-16232, a SmartConsole authentication bypass that yields an application login token and full administrative privileges, has been exploited since at least July and was added to KEV on 22 July 2026 with a 25 July due date [1]. Check Point’s own description of CVE-2026-16232 notes that remote exploitation requires internet access to the management server IP and a configuration that does not restrict Trusted Clients — the same control it offers as a mitigation for the new flaw.

What to do

• Apply the Check Point LivePatch for CVE-2026-91843 to every Security Management Server and Log Server. Given the pre-authentication attack surface, patch outside your normal change window if that is what it takes to get it done quickly.
• If you cannot patch immediately, restrict management access to trusted IP addresses and subnets under Manage & Settings > Permissions & Administrators > Trusted Clients in SmartConsole, and apply Check Point’s hardening guidance [1]. Source [1] describes this mitigation in the SmartConsole management context; it does not say whether Trusted Clients also constrains access to the Log Server, so check the vendor advisory for that case.
• Confirm no management server or log server is reachable from the internet. Put them behind a jump host or management VLAN.
• Search Audit and Admin login logs for Administrator failed to log in: Username too long. Treat hits as attempted exploitation and investigate the source address [1].
• Verify CVE-2026-85102 and CVE-2026-85103 are patched on gateways and management systems. CVE-2026-85103 affects all management deployments even without VPN configured [1].
• Check that CVE-2026-50751 and CVE-2026-16232 are remediated. Both are in KEV with past-due dates; if either was unpatched during the exploitation windows described above, run an incident review rather than just patching.
• After patching the management server, re-verify policy and administrator accounts. A compromise there can be used to change enforcement quietly.