Critical Check Point Vulnerability Opens Root Access to Management Servers

Check Point Software has released fixes for a critical vulnerability that lets attackers execute arbitrary code with root privileges on management systems.

What's the problem

The vulnerability has been assigned the identifier CVE-2026-91843 and involves a stack-based buffer overflow that occurs during the login stage on Security Management Server instances. These servers manage security gateways (firewalls) and track network security events. The issue also affects the Log Server — a dedicated server that collects and stores the logs generated by Check Point firewalls.

Successful exploitation gives an attacker with no privileges whatsoever the ability to remotely execute code with root rights. The attack, moreover, has low complexity and requires no user interaction. According to the company, all Security Management Server deployments are vulnerable regardless of configuration — including cases where VPN is not used and not configured.

How to protect yourself

For those who cannot immediately install the latest LivePatch, Check Point has offered temporary measures: hardening the vulnerable systems and restricting access to trusted IP addresses and subnets. The relevant settings are configured in the SmartConsole under Manage & Settings → Permissions & Administrators → Trusted Clients.

No signs of active exploitation of CVE-2026-91843 have been recorded so far. Nevertheless, the company has provided guidance on how to spot attack attempts: in audit logs and administrator login logs, look for alerts of the form "Administrator failed to log in: Username too long."

A string of critical holes

This vulnerability is not the only one of late. A week earlier, Check Point had closed another critical RCE vulnerability (CVE-2026-85103), tied to a heap overflow during ASN.1 decoding in the course of processing VPN certificates, as well as a second one (CVE-2026-85102) that allowed unauthenticated attackers to bypass verification and execute code on firewalls.

Some of the earlier flaws have already been exploited in real-world attacks. For instance, the authentication bypass CVE-2026-50751 has been used by a Qilin ransomware affiliate since June, and another similar zero-day (CVE-2026-16232) has been used since at least July to log into the SmartConsole panel with administrator privileges. The Netherlands' National Cyber Security Centre (NCSC-NL), for its part, has urged organizations to prioritize patching CVE-2026-85102 and CVE-2026-85103, anticipating that exploitation will begin soon.

Source: Bleeping Computer