Critical Check Point Flaw Lets Unauthenticated Attackers Run Code as Root

A Critical Flaw in the Firewall's Control Plane

Check Point has patched a critical vulnerability, tracked as CVE-2026-91843 (CVSS 9.8), in its Security Management Server and Log Server products — the systems that control firewall policy and administrator access across an organization's Check Point deployment. The flaw allows an attacker without any login credentials to execute arbitrary code with root privileges over the network.

The bug is a stack overflow in the login process, triggered before any user authentication occurs. According to researchers, the overflow is caused by "a login request that carries a very long username" — a classic memory-corruption pattern that reaches deep enough into the authentication path to hand an attacker full root access.

Technical Details

Affected versions:

• R82.20 — all builds vulnerable; no protective Hotfix available yet at disclosure
• R82.10 — Jumbo Hotfix Take 44 or below
• R82 — Take 126 or below
• R81.20 — Take 166 or below
• R81.10 — Take 190 or below
• R81, R80.40, R80.30, R80.20, R80.10, R80 — end-of-support versions (also vulnerable)
• Standalone deployments, Log Servers, and Multi-Domain servers

Exploitation runs exclusively through the Trusted Clients configuration, which defines which hosts are permitted to connect to the management server via SmartConsole. An attacker who can reach that path with a crafted, oversized username field can trigger the overflow without any valid credentials.

As of the September 17 disclosure, Check Point reports no evidence of active exploitation, though it says indicators of compromise have been shared with customers as a precaution.

Patch and Mitigation

Check Point has released fixes via LivePatch. Organizations with automatic updates enabled are already protected; everyone else should apply the fix described in advisory sk1000155. Systems on out-of-support versions need to contact Check Point support directly for remediation options.

Recommended steps:

1. Restrict Trusted Clients to known management hosts only — never set it to "any IP address"
2. Never expose the management server directly to the internet — require a VPN for administrative access
3. Verify LivePatch is installed by running cplp list on the management server

Also This Week: Kaspersky and Tanium

The Check Point disclosure landed alongside a batch of other enterprise-security patches:

Tanium published five advisories covering multiple products:

• Tanium Asset — two high-severity SQL injection flaws letting authenticated attackers access restricted data or manipulate SQL queries
• Tanium Threat Response — one high-severity SQL query tampering flaw, one medium-severity SSRF issue permitting unauthorized data access, and one medium-severity access-control flaw allowing unauthorized alert creation or modification

Kaspersky patched Kaspersky Security 10 for Linux Mail Server against a Redis-related vulnerability (originally discovered in 2023) that could cause the product to malfunction or enable code execution when processing files of a certain format.

None of these additional flaws have published CVSS scores at this time, and no evidence of active exploitation has been reported for any of them.

Sources

• The Hacker News — Critical Check Point Management Server Flaw
• SecurityWeek — Check Point, Kaspersky, Tanium Patch Product Vulnerabilities