Full Report
A critical vulnerability in Check Point's Security Management and Log Servers could allow an attacker without login credentials to run code as root on those servers over the network. The Security Management Server is the system that controls firewall policy and administrator access. Check Point has released a fix through its LivePatch update channel and says it has no indication that the flaw
Analysis Summary
# Vulnerability: Critical Stack Overflow in Check Point Security Management Servers
## CVE Details
- **CVE ID:** CVE-2026-91843
- **CVSS Score:** 9.8 (Critical)
- **CWE:** Stack-based Buffer Overflow
## Affected Systems
- **Products:** Check Point Security Management Servers, Log Servers, Multi-Domain Servers, and Standalone deployments (Management + Gateway).
- **Versions:**
- R82.10 (Jumbo Hotfix Take 44 or below)
- R82 (Jumbo Hotfix Take 126 or below)
- R81.20 (Jumbo Hotfix Take 166 or below)
- R81.10 (Jumbo Hotfix Take 190 or below)
- R82.20 (All builds currently vulnerable until a Jumbo Hotfix is released)
- Legacy Versions (End of Support): R81, R80.40, R80.30, R80.20, R80.10, and R80.
- **Configurations:** Systems where the "Trusted Clients" setting is not strictly limited, or systems exposing management interfaces to the network/internet.
## Vulnerability Description
The flaw is a stack-based buffer overflow located in the login process of the Security Management Server. The vulnerability is triggered during the handling of authentication requests—specifically before a user is even authenticated. An attacker can trigger the overflow by sending a login request containing an excessively long username string. Because this occurs in the pre-authentication phase, no valid credentials are required to exploit the flaw.
## Exploitation
- **Status:** Not exploited in the wild (as of September 17, 2026). No public Proof-of-Concept (PoC) currently available.
- **Complexity:** Low (Triggered by a crafted login request).
- **Attack Vector:** Network.
## Impact
- **Confidentiality:** High (Full access to firewall policies and admin credentials).
- **Integrity:** High (Ability to run code as **root**; unauthorized policy modifications).
- **Availability:** High (Potential for complete system takeover or service disruption).
## Remediation
### Patches
- **LivePatch:** Apply the fix via the LivePatch update channel as described in advisory **sk1000155**.
- **Jumbo Hotfixes:** Upgrade to a version higher than the "Affected Versions" listed above.
- **Legacy Systems:** Check Point has developed fixes for out-of-support versions; customers must log a support ticket to receive them.
- **Cloud:** Smart-1 Cloud services have been patched automatically by Check Point.
### Workarounds
- **Trusted Clients:** Immediately restrict "Trusted Clients" settings in SmartConsole to specific, known IP addresses. Ensure it is NOT set to "Any."
- **Network Isolation:** Ensure Security Management and Log Servers are not exposed directly to the internet.
## Detection
- **Indicators of Compromise:** Unusual login attempts characterized by extremely long strings in the username field.
- **Detection Methods:**
- Run the command `cplp list` on the server to verify if the LivePatch is installed and active.
- Monitor management server logs for crashes in the login service or abnormal authentication traffic.
## References
- **Check Point Advisory:** hxxps://support[.]checkpoint[.]com/results/sk/sk1000155
- **CheckMates Community Alert:** hxxps://community[.]checkpoint[.]com/t5/General-Topics/Important-Notification-Action-required-Critical-Security-Update/m-p/282409
- **CVE Record:** hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-91843
- **Censys Advisory:** hxxps://censys[.]com/advisory/cve-2026-91843/