Check Point Fixes Critical Pre-Auth Root RCE in Security Management Servers

Check Point has issued an urgent security patch for a critical vulnerability in its Security Management and Log Servers that allows unauthenticated attackers to execute arbitrary code with root privileges over the network.

Tracked as CVE-2026-91843 and assigned a maximum-severity CVSS score of 9.8, the vulnerability stems from a stack-based buffer overflow in the server’s authentication handling process. Because the flaw exists in the initial login handling pipeline before user credentials are verified, a remote adversary can trigger the overflow simply by submitting a crafted login request containing an excessively long username string.

While Check Point and CISA confirm there are no active indications of wild exploitation yet, the flaw presents an immediate risk to enterprise perimeters due to the elevated privileges granted upon success.

Technical Analysis and Threat Blast Radius

Stack-based buffer overflows occur when an application writes more data to a buffer located on the call stack than was allocated for it, allowing adjacent memory—including function return addresses—to be overwritten. In the context of CVE-2026-91843, the vulnerable process runs with top-level system privileges (root). Successful exploitation allows an attacker to alter execution flow and execute arbitrary commands directly on the host operating system.

In enterprise architecture, the Check Point Security Management Server functions as the central nervous system for network defense. It maintains global firewall policies, manages administrator access control, stores logging telemetry, and distributes security settings to downstream gateways.

If an attacker achieves root-level remote code execution on a management node, the blast radius spans the entire managed network fabric. An attacker can:

• Modify or disable Access Control policies across perimeter firewalls.
• Intercept administrator credentials and session tokens.
• Pivot internally from the management plane into segmented enterprise zones.
• Push malicious binaries or rogue software blade configurations directly to connected gateways.

The vulnerability affects standard Security Management Servers, Log Servers, Multi-Domain Management deployments, and Standalone installations (where the management server and firewall gateway reside on the same physical or virtual appliance). Hosted Smart-1 Cloud environments have already been updated by Check Point and are not impacted.

Network Exposure and Vulnerable Configurations

The execution path for CVE-2026-91843 is reached through the Trusted Clients setting in SmartConsole, which defines which IP addresses or subnets are permitted to initiate management connections. If a management server is misconfigured to accept connections from any IP address (“Any”) and is directly exposed to the external internet without mandatory VPN boundary protections, it becomes immediately reachable by external threat actors.

Data from internet scanning company Censys indicates that approximately 3,836 hosts worldwide present default Check Point management and log server identities online. While this host count reflects total online server presence rather than confirmed vulnerable instances, it underscores the persistent issue of critical control plane interfaces being directly accessible from public IP space.

This vulnerability represents the fifth critical unauthenticated flaw affecting Check Point management infrastructure disclosed since July. Previous entries in this vulnerability sequence include:

• CVE-2026-16232: A SmartConsole authentication bypass exploited in the wild against management interfaces exposed directly without IP restrictions.
• CVE-2026-62144: An unauthenticated management bypass flaw.
• CVE-2026-18574: An unauthenticated command execution flaw in the management service.
• CVE-2026-85103: A heap overflow in VPN certificate decoding affecting Quantum Security Management.

Affected Software Versions

Check Point has confirmed that the vulnerable path impacts multiple active and legacy software branches:

• R81.10: Affected at Jumbo Hotfix Take 190 and lower.
• R82.20: All current builds are vulnerable, and no standard Jumbo Hotfix package has resolved this branch yet.
• End-of-Support (EOS) Releases: R81, R80.40, R80.30, R80.20, R80.10, and R80 are all affected. (Out-of-support customers must contact Check Point support directly to receive a backported fix).

Remediation and Mitigation Guidelines

Administrators responsible for Check Point infrastructure should perform immediate remediation and verification:

1. Apply the Patch via LivePatch: Deploy the fix documented in Check Point advisory sk1000155. Systems with automatic security updates enabled (configured under SmartConsole > Global Properties > Data Access Control) will receive the update automatically over the LivePatch channel. However, because LivePatch rollouts can occur in staged waves, do not assume installation has completed automatically.
2. Verify Installation: Log into the management server command line and execute the command cplp list to review installed LivePatch packages and confirm that sk1000155 is active.
3. Restrict Trusted Clients: Open SmartConsole, navigate to Manage & Settings > Permissions & Administrators > Trusted Clients, and verify that the allowed client host list is explicitly restricted to designated internal administrative IP addresses. Ensure the setting is never set to “Any IP address.”
4. Eliminate Direct Exposure: Confirm that management and log server interfaces are not exposed to the open internet. Access to SmartConsole and management daemons must be restricted to encrypted VPN tunnels or dedicated out-of-band management networks.