Loading story…
Check Point released fixes for CVE-2026-91843, a critical (CVSS 9.8) stack-based buffer overflow in the login process of its Security Management and Log Server products. A remote, unauthenticated attacker can reportedly submit an excessively long username to execute arbitrary code with root privileges before authentication. Affected products include Security Management Server, Multi-Domain Security Management Server, Log Server, and Multi-Domain Log Server across R81.20, R82, R82.10, R82.20, and certain older releases; Smart-1 Cloud is not affected.
Administrators should urgently deploy Check Point’s LivePatch or applicable offline updates, verify remediation on every management and logging server, and review failed-login records for oversized-username attempts. Organizations should also restrict SmartConsole Trusted Clients until patching is validated. Check Point has not reported active exploitation or disclosed a public exploit chain; releases earlier than R81.20 are end of support and will not receive patches, requiring an upgrade or replacement strategy.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security published advisory AV26-933 covering CVE-2026-91843 in Check Point Security Management, Multi-Domain Security Management, Log Server, and Multi-Domain Log Server products. It advised administrators to review Check Point guidance and apply applicable updates.
Check Point issued security updates, including LivePatch and offline urgent updates, for CVE-2026-91843, a CVSS 9.8 stack-based buffer overflow in Security Management and Log Server products. The flaw can be triggered before authentication using an excessively long username and may permit unauthenticated remote code execution with root privileges; unsupported releases earlier than R81.20 will not receive patches.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourceacn.gov.it
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point released fixes for **CVE-2026-18574**, a critical authentication-bypass flaw in **Security Management Server** and **Multi-Domain Security Management Server (MDS)** that can let an unauthenticated remote attacker with network access to management services execute arbitrary commands. The vulnerability carries a **CVSS 4.0 score of 9.3** and is classified as **`CWE-288`**, with impact that can extend to full compromise of the security management environment. Check Point said it discovered the issue internally and reported no evidence of active exploitation, while noting that **Smart-1 Cloud** customers are already protected. Supported affected versions include **R81.20, R82, and R82.10**, with older affected releases from **R80 through R81.10** now end-of-support; fixes were issued through **Jumbo Hotfix Accumulator** updates. The company urged customers to apply patches, restrict **Trusted Clients**, limit management access to trusted administrator systems, avoid exposing management interfaces to untrusted networks or the public internet, and monitor for unauthorized activity.
Aug 8, 2026
Check Point disclosed **`CVE-2026-16232`**, a high-severity SmartConsole authentication bypass affecting **Security Management**, **Multi-Domain Management**, **Firewall**, and **Multi-Domain Log Server** products across multiple versions. The flaw, rated **CVSS 9.3**, allows attackers to bypass SmartConsole login using an application token, and Check Point said it has already been exploited against a small number of customers with specific exposed configurations. Check Point released fixes for `CVE-2026-16232` along with related flaws **`CVE-2026-62144`** and **`CVE-2026-62145`**, while the Canadian Centre for Cyber Security issued advisory **AV26-735** urging organizations to review the vendor guidance and apply mitigations. The highest risk is for management interfaces exposed directly to the internet without IP restrictions, and defenders were advised to install the available jumbo hotfix, restrict trusted GUI clients by IP address, and place management access behind a firewall until patching is complete.
Aug 15, 2026
Check Point issued emergency updates for two critical vulnerabilities, **CVE-2026-85102** and **CVE-2026-85103**, affecting Quantum Security Gateways, Security Management systems, Spark Firewalls, and Remote Access and Site-to-Site VPN deployments. An unauthenticated attacker could exploit flaws in certificate handling during VPN negotiation to execute arbitrary code on exposed perimeter appliances; CVE-2026-85102 involves improper certificate validation and authentication bypass, while CVE-2026-85103 is a heap overflow in ASN.1 certificate decoding. Check Point has provided fixes through LivePatch and Jumbo Hotfix Accumulator packages. Organizations should apply available updates promptly and, where patching is delayed, reduce VPN exposure using implied-rule and UDP-port controls. No public proof-of-concept exploit was reported at disclosure, but internet-facing VPN infrastructure is a high-priority remediation target.
Sep 15, 2026