widely-deployed-product-advisoryinternet-facing-service-vulnerabilityend-of-life-softwareprivilege-escalation-technique

Critical Check Point Login Overflow Enables Unauthenticated Root RCE

Patch & Detection Intelligence · 13 sources · Updated 2mo ago · First seen Sep 16, 2026

Check Point released fixes for CVE-2026-91843, a critical (CVSS 9.8) stack-based buffer overflow in the login process of its Security Management and Log Server products. A remote, unauthenticated attacker can reportedly submit an excessively long username to execute arbitrary code with root privileges before authentication. Affected products include Security Management Server, Multi-Domain Security Management Server, Log Server, and Multi-Domain Log Server across R81.20, R82, R82.10, R82.20, and certain older releases; Smart-1 Cloud is not affected.

Administrators should urgently deploy Check Point’s LivePatch or applicable offline updates, verify remediation on every management and logging server, and review failed-login records for oversized-username attempts. Organizations should also restrict SmartConsole Trusted Clients until patching is validated. Check Point has not reported active exploitation or disclosed a public exploit chain; releases earlier than R81.20 are end of support and will not receive patches, requiring an upgrade or replacement strategy.

Patch this, or something else?See real exploitation activity before you spend the cycle.

Triage this advisory

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

6 events · Sep 16, 2026 – Sep 18, 2026

Sep 18, 20262mo ago
Check Point publishes mitigations and detection indicator for CVE-2026-91843
Check Point advised organizations unable to deploy LivePatch to harden affected systems and restrict SmartConsole Trusted Clients access to trusted IP addresses or subnets. It said attempted exploitation can be identified in Audit and Admin login logs by the event "Administrator failed to log in: Username too long."
New Check Point flaw lets hackers execute code with root privileges
Sep 18, 20262mo ago
Check Point patches six flaws, including CVE-2026-91843
Check Point published security updates for six vulnerabilities affecting its security-management, logging, gateway, and Spark Firewall products, including CVE-2026-91843 and five additional CVEs. The guidance directs affected R82.20 users to apply LivePatch Take 29 or later for CVE-2026-91843 and specifies Jumbo Hotfix, LivePatch, and Spark Firewall build updates for the other flaws.
Check Point 제품 보안 업데이트 권고 > 보안공지 > 알림마당 : KISA 보호나라&KrCERT/CC
Reported Sep 17, 20262mo ago
Check Point confirms all R82.20 builds vulnerable to CVE-2026-91843
Check Point confirmed that every R82.20 build is vulnerable to CVE-2026-91843 and that no Jumbo Hotfix protected that branch at the time of reporting. It also said fixes for affected end-of-support versions may be available through its support channel.
Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root
Sep 17, 20262mo ago
Canadian Cyber Centre issues advisory AV26-933
The Canadian Centre for Cyber Security published advisory AV26-933 covering CVE-2026-91843 in Check Point Security Management, Multi-Domain Security Management, Log Server, and Multi-Domain Log Server products. It advised administrators to review Check Point guidance and apply applicable updates.
Check Point security advisory (AV26-933) - Canadian Centre for Cyber Security
Reported Sep 16, 20262mo ago
Check Point releases fix for CVE-2026-91843
Check Point issued security updates, including LivePatch and offline urgent updates, for CVE-2026-91843, a CVSS 9.8 stack-based buffer overflow in Security Management and Log Server products. The flaw can be triggered before authentication using an excessively long username and may permit unauthenticated remote code execution with root privileges; unsupported releases earlier than R81.20 will not receive patches.
Critical Check Point Bug Lets Remote Hackers Gain Root Access Without Authentication
Sep 16, 20262mo ago
Check Point reports no exploitation; Censys assesses exposed roles
As of 2026-09-16, Check Point said it had no indication that CVE-2026-91843 was exploited in the wild, while Censys reported no public proof-of-concept exploit. Censys identified 3,836 internet-observable hosts with Security Management or Log Server roles, but said this did not confirm vulnerability because build and hotfix levels could not be determined passively.
Check Point Fixes Critical CVE-2026-91843 Allowing Root Code Execution

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Unauthenticated Root RCE in Check Point Security Management and Log Servers (CVE-2026-91843)

Affected products

5 linked

Quantum Security ManagementLog ServerSecurity Management ServerMulti-Domain Security Management ServerMulti-Domain Log Server

Organizations

1 linked

Check Point Software Technologies

Do you run this?See real exploitation activity behind this advisory so you can triage it against everything else in the queue.

Prioritize This Patch

Source coverage

Sources

13 references tracked. Mallory keeps watching after this page renders.

Bleeping ComputerNews · Sep 18, 2026

New Check Point flaw lets hackers execute code with root privilegesOpen source ↗

Security AffairsNews · Sep 18, 2026

Check Point Fixes Critical CVE-2026-91843 Allowing Root Code ExecutionOpen source ↗

HeiseNews · Sep 18, 2026

Root-Sicherheitslücke gefährdet Check Point Security Management and Log Servers | heise onlineOpen source ↗

Krcert KisaNews · Sep 18, 2026

Check Point 제품 보안 업데이트 권고 > 보안공지 > 알림마당 : KISA 보호나라&KrCERT/CCOpen source ↗

5 additional sources from 17-09-2026 to 17-09-2026

Cyber Security NewsNews · Sep 16, 2026

Critical Check Point Bug Lets Remote Hackers Gain Root Access Without AuthenticationOpen source ↗

Cryptika BlogNews · Sep 16, 2026

Check Point Vulnerability Lets Remote Hackers Gain Root Access Without Authentication | Cryptika CybersecurityOpen source ↗

CveAdvisories · Sep 16, 2026

CVE Record: CVE-2026-91843Open source ↗

UnclassifiedNews

UnclassifiedOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News