Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root

Summary: Check Point disclosed CVE-2026-91843, a stack overflow in the login process of its Security Management and Log Servers, rated 9.8 on CVSS, that lets an unauthenticated attacker run code as root over the network, triggered by a login request carrying a very long username. Check Point issued a LivePatch fix, said it has no indication of exploitation, and CISA recorded exploitation as "none" as of September 17, 2026, while Censys counted 3,836 hosts worldwide presenting the default Check Point management and log server identity.
Why it matters: The vulnerable path runs only through the Trusted Clients setting, and the same mitigation - limiting Trusted Clients to trusted addresses - was the first step recommended for CVE-2026-16232, a SmartConsole authentication bypass that was exploited in July against customers whose management was exposed directly to the internet without IP restrictions. This is the fifth critical flaw since July 22 reachable on the Security Management Server without logging in, and Censys notes that every R82.20 build is affected with no Jumbo Hotfix yet protecting that branch.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-91843
Related: Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks Cyber Risks ·
⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, Click Fix Attacks, Click Fix Surge, and Browser Hijacks Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026