Check Point CVE‑2026‑91843: Root Privilege RCE in Management Server

What happened

Check Point Software disclosed a critical stack‑based buffer overflow in the login routine of its Security Management Server and Log Server. The flaw, tracked as CVE‑2026‑91843, permits unauthenticated remote attackers to execute arbitrary code with root privileges on affected management systems.

Impact

Both the Security Management Server, which controls firewalls and aggregates security events, and the dedicated Log Server are vulnerable. Successful exploitation yields full root access without user interaction, enabling attackers to compromise the entire management infrastructure.

What to do

• Apply the latest security update or LivePatch released by Check Point as soon as possible.
• If immediate patching is not feasible, harden the affected servers by restricting inbound traffic to known, trusted IP addresses or subnets. Edit the Trusted Clients list under Manage & Settings > Permissions & Administrators > Trusted Clients in SmartConsole.
• Monitor logs for failed administrator login attempts that match the pattern “Administrator failed to log …” to detect potential exploitation attempts.

Mitigation status

Check Point has not reported active exploitation of CVE‑2026‑91843, but the company urges all customers to update promptly and implement the temporary hardening measures until the permanent fix is deployed.