An Overlong Username, a Root Shell
Check Point has patched a critical stack-based buffer overflow, tracked as CVE-2026-91843 (CVSS 9.8), in the unauthenticated login process of its Security Management Server and Log Server — including the Multi-Domain variants of both. A remote attacker who sends a crafted login request with an excessively long username can trigger the overflow and execute arbitrary code as root, before authentication ever completes and without needing any credentials or user interaction.
Security Management Server is the system administrators use to push firewall policy, oversee Security Gateways, and monitor security events across a Check Point deployment. Check Point's own framing of the risk is blunt: an attacker who compromises the management server effectively owns every gateway, every policy, and every rule it controls.
Vulnerability Details
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-91843 |
| CWE | CWE-121 (Stack-Based Buffer Overflow) |
| CVSS Score | 9.8 (Critical) — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Affected Products | Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server |
| Disclosed | September 16, 2026 |
| Discovery | Found internally by Check Point; no reported exploitation |
Check Point states all Security Management Server deployments are vulnerable regardless of configuration, and the flaw is present even when VPN is not in use or configured — there's no feature-based way to opt out of exposure short of patching.
This is the fifth critical management-plane vulnerability Check Point has disclosed in its product line in under eight weeks.
Remediation
Check Point ships the fix via LivePatch rather than a standalone build:
| Track | Fixed Take |
|---|---|
| R82.20 | Take 29 |
| R82.10 | Take 28 |
| R82 | Take 28 |
| R81.20 | Take 28 |
Systems with automatic updates enabled per sk175504 receive the fix automatically. Where LivePatch can't be deployed immediately, Check Point recommends:
- Restricting SmartConsole access to trusted IP addresses/subnets (Manage & Settings → Permissions & Administrators → Trusted Clients)
- General hardening of exposed management systems
Detection
Administrators can watch the Audit and Admin login logs for the alert "Administrator failed to log in: Username too long" — a signature of attempted exploitation of the overflow.
Check Point reports no confirmed in-the-wild exploitation as of publication, and the CVE is not yet listed in CISA's Known Exploited Vulnerabilities catalog. Given the low attack complexity and lack of authentication required, organizations running exposed Security Management Server or Log Server instances should treat patching as urgent rather than wait for confirmed exploitation.