Loading vulnerability…
Unauthenticated Root RCE in Check Point Security Management and Log Servers
CVE-2026-91843 is a stack-based buffer overflow in the pre-authentication login handler of Check Point Quantum Security Management Server, Multi-Domain Security Management Server, Log Server, and Multi-Domain Log Server. A crafted login request containing an excessively long username can trigger the overflow before authentication completes, potentially enabling remote arbitrary code execution as root. The vulnerable path is reachable through the Trusted Clients interface used for SmartConsole connections. Affected releases include unpatched R82.20; R82.10 through Jumbo Hotfix Take 44; R82 through Take 126; R81.20 through Take 166; R81.10 through Take 190; and R81 and R80.x releases. Standalone installations with a management role are also affected. Smart-1 Cloud was protected before public disclosure. The vulnerability has a CVSS v3.1 score of 9.8.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can completely compromise the affected management or logging server, with high confidentiality, integrity, and availability impact. Root-level access can expose or permit manipulation of security policies, administrator information, management data, and collected logs. Attackers could disable security controls, disrupt operations, and potentially extend compromise into the environment managed by the server.
If you can’t patch tonight, do this now.
Until remediation is verified, restrict SmartConsole Trusted Clients to explicitly approved administrator addresses or isolated management subnets; do not permit the 'Any' client type. Restrict network access to management and logging interfaces, remove direct Internet exposure, and require VPN-based administrative access where appropriate. Review SmartConsole Audit and Admin login logs for 'Administrator failed to log in: Username too long' and investigate repeated failures, unexpected sources, unusual processes, and unauthorized administrative or policy changes. This event indicates an oversized-username attempt, not proof of successful compromise. Access restrictions and monitoring do not replace patching.
Patch, then assume compromise.
Install the applicable Check Point security update described in advisory sk1000155 on every affected management and log server. Supported-branch fixes include LivePatch Take 29 or later for R82.20 and LivePatch Take 28 or later for R82.10, R82, and R81.20. These are LivePatch iteration numbers, not Jumbo Hotfix Take levels. Automatic security updates may already have deployed the fix, but installation must be verified. Run 'cplp list' in Expert mode on each server and confirm that the fwm:fwm patch is armed, uses livepatch mode, and references CVE-2026-91843. Upgrade end-of-support releases to a supported branch and apply its applicable update; contact Check Point Support for any interim remediation options. Patching does not resolve an existing compromise.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
78 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.