Check Point Software Technologies — Critical Management Server Flaw Allows Unauthenticated Remote Code Execution as Root (CVE-2026-91843)

Publication date: September 17, 2026
Category: Vulnerability / Enterprise Security

Introduction

Security researchers and Check Point incident response teams have disclosed a series of critical vulnerabilities affecting Security Management Servers and Log Servers. The most severe among them, tracked as CVE-2026-91843, allows an unauthenticated remote attacker to execute arbitrary code with superuser (root) privileges over the network. This flaw compounds a string of critical management platform issues reported over recent months, demanding immediate remediation from system administrators and global cybersecurity defense teams.

What is CVE-2026-91843 and the Management Flaw Series? (General Analysis)

Check Point’s centralized management ecosystem serves as the core orchestrator for firewall policies, administrative access, and multi-gateway control in high-security corporate environments. Flaws within this critical component pose an existential risk to organizational security, as compromising the administration console grants total control over connected perimeter infrastructure.

The official NVD verified metrics for the CVEs involved in this advisory cycle are detailed below:

  • CVE-2026-91843 (NVD Verified Fact):

    • Official Description: A stack overflow during the unauthenticated login process may allow an attacker to run arbitrary code remotely with root privileges.
    • Official CVSS v3.1 Score: 9.8 (CRITICAL) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    • Official CWE Classification: CWE-121 (Stack-based Buffer Overflow)
    • CISA KEV Catalog: Not reported

  • CVE-2026-16232 (NVD Verified Fact):

    • Official Description: An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges.
    • Official CVSS v4.0 Score: 9.3 (CRITICAL) — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/...
    • Official CWE Classification: CWE-287 (Improper Authentication)
    • CISA KEV Catalog: Yes (actively exploited in limited campaigns)

  • CVE-2026-62144 (NVD Verified Fact):

    • Official Description: An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security Management allows an unauthenticated remote attacker to execute administrative commands on the Management Server.
    • Official CVSS v3.1 Score: 9.1 (CRITICAL) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    • Official CWE Classification: CWE-287
    • CISA KEV Catalog: Not reported

  • CVE-2026-18574 (NVD Verified Fact):

    • Official Description: An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server (MDS) could allow an unauthenticated remote attacker with network access to Management services to execute arbitrary commands.
    • Official CVSS v4.0 Score: 9.3 (CRITICAL) — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/...
    • Official CWE Classification: CWE-288 (Authentication Bypass Using an Alternate Path or Channel)
    • CISA KEV Catalog: Not reported

  • CVE-2026-85103 (NVD Verified Fact):

    • Official Description: A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems.
    • Official CVSS v3.1 Score: 9.8 (CRITICAL) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    • Official CWE Classification: CWE-122 (Heap-based Buffer Overflow)
    • CISA KEV Catalog: Not reported

How Does It Work? (Technical Analysis)

Technical insights provided by internet scanning firm Censys and vendor advisories detail the attack vector as follows:

  • Initial Exploit Entry Flow (CVE-2026-91843): The vulnerability resides within the routine handling login requests prior to user authentication. The stack overflow is triggered by submitting a specially crafted HTTP or management request carrying an excessively long username, which breaches allocated stack buffer memory boundaries.
  • Trusted Clients Path Constraint: According to vendor telemetry, the vulnerable execution path traverses strictly through the “Trusted Clients” setting, which dictates which hosts or IP addresses may connect to the management server via SmartConsole. If a server is directly exposed to the public internet without IP restrictions, the attack surface becomes fully reachable by threat actors.
  • Arbitrary Code Execution: By corrupting stack memory with attacker-controlled input, return pointers can be overwritten. This diverts execution flow toward injected malicious payloads, successfully executing instructions under maximum privileges (root) on the underlying operating system.

Affected Systems / Environments

The following software branches and Jumbo Hotfix Take levels are impacted by the management stack overflow flaw:

  • R82.10: Jumbo Hotfix Take 44 or below.
  • R82: Jumbo Hotfix Take 126 or below.
  • R81.20: Jumbo Hotfix Take 166 or below.
  • R81.10: Jumbo Hotfix Take 190 or below.
  • R80.x and R81 (un-suffixed): End-of-Support releases requiring dedicated support paths.
  • R82.20: All current builds lack native Jumbo Hotfix mitigation.
  • Additional Deployments: Standalone deployments, Log Servers, and Multi-Domain Servers.
CVECategory (CWE)ImpactCVSSVector (summarized)
CVE-2026-91843CWE-121 (Stack Overflow)Code execution as root9.8 (Critical)AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2026-16232CWE-287 (Auth Bypass)Admin token theft9.3 (Critical)AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H
CVE-2026-62144CWE-287 (Auth Bypass)Remote admin commands9.1 (Critical)AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVE-2026-18574CWE-288 (Alt. Path Bypass)Arbitrary command execution9.3 (Critical)AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H
CVE-2026-85103CWE-122 (Heap Overflow)Arbitrary code execution9.8 (Critical)AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Mitigation and Detection

Remediation

  1. LivePatch Deployment: Administrators must promptly apply the fix via the LivePatch automated update channel or by following advisory sk1000155.
  2. Verify Automated Updates: Execute the cplp list command on the server terminal to confirm which LivePatches are currently installed and active.
  3. Restrict Trusted Clients: Regardless of patch status, ensure that management access is strictly limited to known trusted hosts and internal IPs rather than open configurations (0.0.0.0/0). Avoid exposing management interfaces directly to the internet; enforce corporate VPN access.
  4. End-of-Support Support: Organizations running unsupported versions (R81.10 and older) must file a support ticket with Check Point to obtain custom fixes.

Detection

SOC analysts and incident responders should actively monitor authentication logs for anomalous HTTP requests carrying abnormal username string lengths directed toward SmartConsole login endpoints or management daemons.

Defensive Intelligence Note: The presence of unauthenticated requests containing atypical parameter lengths within management server access logs serves as a strong indicator of scanning activity or buffer overflow exploitation attempts targeting CVE-2026-91843.

Wrapping Up

Vulnerability CVE-2026-91843 marks the fifth critical flaw reported in Check Point management servers since July 2026, underlining the exposed attack surface within enterprise infrastructure solutions. While active in-the-wild exploitation has not been observed for this specific CVE at the time of publication (unlike the historically exploited CVE-2026-16232), the extreme severity and root-level code execution capability necessitate rigorous review of Trusted Client segmentation and prompt patch deployment via LivePatch.

References