Check Point Root RCE via Management Server Login Flaw

Check Point Software has disclosed a critical vulnerability that lets unauthenticated attackers execute code with root privileges on Security Management Server and Log Server systems. The flaw, tracked as CVE-2026-91843, stems from a stack-based buffer overflow in the login process. Consequently, any exposed management interface is at severe risk.

What Happened: Critical Check Point Flaw Grants Root Remote Code Execution

On September 18, 2026, Check Point published security updates to fix CVE-2026-91843, a stack-based buffer overflow in the login handling of its Security Management Server. Furthermore, the same flaw affects the Check Point Log Server, which collects and stores firewall logs.

Successful exploitation allows threat actors without any privileges to gain root remote code execution. Moreover, the attack is low complexity and requires no user interaction. Therefore, any internet-exposed management interface is a prime target.

Check Point has not flagged this specific flaw as actively exploited. However, the company has seen active exploitation of other related vulnerabilities in recent months, which suggests attackers are already targeting Check Point management and VPN infrastructure.

Technical Details of CVE-2026-91843

The vulnerability exists in the login process for Security Management Server instances. These servers manage Security Gateways (firewalls) and monitor network security events across an organization.

A stack-based buffer overflow occurs when an overly long username is submitted during authentication. The vulnerable code does not properly validate input length, which lets an attacker overwrite the stack and execute arbitrary code with root privileges.

Affected Components

• Check Point Security Management Server
• Check Point Log Server

Attack Characteristics

• Attack Vector: Network
• Privileges Required: None
• User Interaction: None
• Complexity: Low
• Impact: Remote code execution as root

Detection Guidance

Security teams can detect exploitation attempts by monitoring Audit and Admin login logs for the following alert:

• “Administrator failed to log in: Username too long”

Furthermore, organizations should review access logs for unexpected login attempts to management interfaces from untrusted IP addresses.

Business and Operational Impact

CVE-2026-91843 poses an existential risk to organizations running Check Point security infrastructure. The impact includes:

• Complete infrastructure compromise: Root access to management servers lets attackers reconfigure firewalls, disable security policies, and pivot across networks
• Data theft: Attackers can exfiltrate logs, security configurations, and network topology information
• Lateral movement: Compromised management servers provide a trusted foothold for broader network infiltration
• Operational disruption: Firewall policy changes can block legitimate traffic or open sensitive systems to the internet
• Ransomware staging: Root access enables attackers to deploy ransomware across managed endpoints

Therefore, organizations should treat this as a maximum-priority patching event.

Mitigation and Recommendations

Immediate Actions for Defenders

1. Apply Check Point’s latest LivePatch or security update immediately
2. Restrict management interface access to trusted IP addresses and subnets
3. Monitor Audit and Admin login logs for “Username too long” alerts
4. Review recent administrator login activity for anomalies
5. Segment management networks from production traffic

Temporary Hardening Measures

For organizations unable to patch immediately, Check Point recommends the following temporary mitigations:

• Harden vulnerable systems using Check Point’s hardening guidelines
• Limit access to trusted IP addresses or subnets via SmartConsole under Manage & Settings > Permissions & Administrators > Trusted Clients

Related Vulnerabilities to Address

Check Point also patched two additional critical flaws this month that deserve immediate attention:

• CVE-2026-85103: Heap overflow in VPN certificate ASN.1 decoding that affects firewalls and management systems
• CVE-2026-85102: Authentication bypass enabling unauthenticated remote code execution on vulnerable firewalls

The Dutch National Cyber Security Centre (NCSC-NL) has warned that exploitation of CVE-2026-85102 and CVE-2026-85103 is imminent.

Bottom line: CVE-2026-91843 is a critical root remote code execution flaw in Check Point management infrastructure. Organizations must patch immediately, restrict management access, and monitor logs for signs of exploitation.

Incident Summary

CVE ID:	CVE-2026-91843
Affected Systems:	Check Point Security Management Server, Check Point Log Server
Disclosure Date:	September 18, 2026
Patch Status:	Security updates available via LivePatch
Severity:	Critical (CVSS pending; root RCE, no privileges required)
Exploitation Status:	No confirmed active exploitation reported

References

1. Check Point Software, “CVE-2026-91843 Security Advisory,” September 18, 2026, https://support.checkpoint.com/results/sk/sk1000118, accessed September 18, 2026.
2. National Vulnerability Database (NVD), “CVE-2026-91843 Detail,” https://nvd.nist.gov/vuln/detail/cve-2026-91843, accessed September 18, 2026.
3. Sergiu Gatlan, “New Check Point flaw lets hackers execute code with root privileges,” BleepingComputer, September 18, 2026, https://www.bleepingcomputer.com/news/security/check-point-warns-critical-flaw-lets-hackers-execute-code-as-root/, accessed September 18, 2026.
4. Dutch National Cyber Security Centre (NCSC-NL), “Critical Check Point VPN flaws exploitation is imminent,” https://www.bleepingcomputer.com/news/security/dutch-ncsc-critical-check-point-vpn-flaws-exploitation-is-imminent/, accessed September 18, 2026.