Threat Intel
Check Point Products Hit by Remote Code Execution Vulnerability (CVE‑2026‑91843)
A newly disclosed flaw in Check Point’s Log and Security Management servers allows attackers to trigger remote code execution by exploiting a malformed username field. Affected releases span R81.20 through R82.20 across Log, Multi‑Domain Log, Security Management, and Multi‑Domain Security Management servers. Check Point advises scanning SmartConsole logs for the pattern "Administrator failed to log in: Username too long" and applying the vendor’s patch ASAP.
RootPwn reports a critical remote code execution (RCE) vulnerability that has been identified in a broad range of Check Point products. The flaw, catalogued as CVE‑2026‑91843, is triggered when an attacker submits a username that exceeds the expected length during a login attempt. The system’s improper handling of this input leads to arbitrary code execution on the affected host.
What’s at Risk?
- Log Server – Versions R81.20 and later, including all R82.x releases
- Multi‑Domain Log Server – Same version range as Log Server
- Security Management Server – Versions R81.20 and later, all R82.x releases
- Multi‑Domain Security Management Server – Same as above
How to Spot It
Check Point recommends searching SmartConsole logs for the following entry:
Administrator failed to log in: Username too long
This pattern indicates a failed login attempt that may have triggered the vulnerability. Log files located under Audit and Admin login sections are the primary sources.
Immediate Actions
- Verify if your environment runs any of the affected versions.
- Apply the latest patch released by Check Point (see Bulletin SK1000155, 16 Sept 2026).
- Disable or limit remote login capabilities until the fix is in place.
- Monitor logs for the specific error message and any suspicious activity.
Reference
Check Point Security Bulletin SK1000155 (16 Sept 2026) and CVE‑2026‑91843 provide detailed technical information and patch download links.
Related vulnerabilities
Check Point CVE‑2026‑91843: Root Privilege RCE in Management Server
Check Point Software has released a patch for CVE‑2026‑91843, a stack‑based buffer overflow that allows unauthenticated attackers to gain root access on Security Management Server and Log Server instances. The flaw can be exploited without user interaction and poses a critical risk to the entire management infrastructure. Defenders should apply the update immediately and, if delayed, restrict access to trusted IPs and monitor for failed admin logins.
Read briefing
Microsoft Office for Mac RCE Vulnerability CVE-2026-88196 – Update Required
Microsoft released a patch for a remote code execution flaw (CVE-2026-88196) affecting Office for Mac. Admins should install the update immediately; other Office products are unaffected.
Read briefing
Microsoft Excel for Mac RCE Vulnerability CVE-2026-81950 – Update Required
Microsoft released a security update for Office for Mac to fix a remote code execution flaw (CVE‑2026‑81950). The vulnerability affects all current Mac versions of Excel and can be triggered by malicious spreadsheets. Defenders should ensure Office for Mac is patched; other Office products are unaffected.
Read briefing
CVE-2026-78512: Microsoft Office for Mac Remote Code Execution Vulnerability Fixed
Microsoft released patches for Office for Mac that address CVE‑2026‑78512, a remote code execution flaw in Word. Mac users must apply the update immediately; other Office products are unaffected.
Read briefing