Check Point CVE-2026-91843: Pre-Auth Stack Overflow on Security Management Servers Enables Root Code Execution
Check Point CVE-2026-91843: Pre-Auth Stack Overflow on Security Management Servers Enables Root Code Execution
Check Point has disclosed a critical vulnerability in its Security Management and Log Servers that could allow an attacker without any login credentials to run code as root on those servers over the network. Tracked as CVE-2026-91843 and rated CVSS 9.8 by Check Point, the flaw is a stack overflow in the login process — the code path that handles requests before a user is authenticated.
Internet scanning company Censys said the overflow is triggered by a login request carrying a very long username. Check Point told The Hacker News the vulnerable path runs only through the Trusted Clients setting, which controls which hosts may connect to the management server through SmartConsole. The company has released a fix through its LivePatch update channel (advisory sk10000155) and says there is no indication the flaw has been exploited in the wild — it is not in CISA's KEV catalog, and no public proof-of-concept existed as of September 16.
What's Affected
The affected branches, by Jumbo Hotfix Accumulator Take: R82.10 (Take 44 or below), R82 (Take 126 or below), R81.20 (Take 166 or below), and R81.10 (Take 190 or below), plus the end-of-support branches R81, R80.40, R80.30, R80.20, R80.10 and R80 — a fix for those is available through Check Point support. Critically, Check Point confirmed that every build of R82.20 is affected and no Jumbo Hotfix protects that branch yet. Standalone deployments, Log Servers, and Multi-Domain servers are also vulnerable. The hosted Smart-1 Cloud service is not affected, as the fix is already in place there.
Censys observes 3,836 hosts worldwide presenting the default identity Check Point gives its management and log servers — a measure of role presence, not a confirmed-vulnerable count.
The Fifth Critical Management Flaw Since July
By The Hacker News' count of Check Point's own CVE records, this is the fifth critical flaw since July 22 that an attacker could reach on the Security Management Server without logging in. The first, CVE-2026-16232 (SmartConsole authentication bypass), was exploited in July and added to CISA's KEV catalog the same day — it affected "a handful of customers" whose management planes were exposed directly to the internet without IP restrictions. CVE-2026-62144, CVE-2026-18574, and CVE-2026-85103 followed in the same window. The pattern is unmistakable: the console that controls the firewall fleet has become a primary attack surface in its own right.
What Should You Do?
- Apply the LivePatch fix from advisory sk10000155 to every Security Management Server and Log Server — then verify it landed. Run
cplp listto confirm installed LivePatches. Don't assume automatic updates protected you: when Check Point shipped fixes for two VPN certificate flaws the week before, customers reported the automatic package arrived days late, rolled out in stages. - Lock down Trusted Clients. In SmartConsole (Manage & Settings → Permissions & Administrators → Trusted Clients), make sure the setting lists known, trusted hosts — never "any IP address." The vulnerable path runs only through this channel.
- Never expose management access directly to the internet. Check Point's hardening guide requires a VPN for management access; if your management plane answers to the public internet, treat that as an emergency.
- R82.20 customers: check daily for the Jumbo Hotfix. No fix exists for that branch yet, which makes Trusted Clients restriction and network segregation your only mitigations until it ships.
- Out-of-support branch customers should log a support ticket — Check Point has a fix ready on request.
The WAF Angle
The uncomfortable lesson of CVE-2026-91843 is that the system which enforces firewall policy is itself a network-facing application with pre-authentication code paths — and a stack overflow triggered by nothing more exotic than a long username. This is precisely the failure mode WAFNinja has documented in WAF admin consoles: management planes get built with less input-validation discipline than the traffic they protect, because "it's only for administrators." The five-flaw run since July shows how productive that assumption has become for attackers. Treat every management plane — WAF, NGFW, load balancer, Kubernetes API — as a Tier 0 web application: IP-allowlist its control channel, require VPN, re-authenticate aggressively, and monitor it like an internet-facing surface even when it isn't. A pre-auth 9.8 hiding in a top vendor's management server for years is your reminder to assume yours has one too.
