Check Point launches CVE-2026-91843 patch that allows pre-authentication CERs on CVE-2026-91843 servers

Check Point published an urgent patch for a critical failure in their Security Management Servers and Log Servers that, according to the company, allows a remote attacker without credentials to run code with root privileges. The error, recorded as CVE-2026-91843 and qualified by Check Point with an 9.8 / 10 on the CVSS scale, is a stack overflow that is activated in the login routine before the user is authenticated; public investigations point out that the failure is caused by sending a login request with a very long user name.

Confirmed facts: Check Point issued a LivePatch to mitigate vulnerability (consulting in its knowledge base: sk1000155), stated that there are no signs of exploitation in real environments and noted that the vulnerable route operates only through adjustment Trusted Customers, which defines which hosts can connect to Management Server via SmartConsole. The US Cyber Security Agency. US (CISA) registered "no" holding in its assessment associated with the CVE and NVD keeps the CVE tab with the technical details reported ( NVD - CVE-2026-91843).

To whom it affects: Security Management and Log Servers servers in the branches and versions indicated by Check Point. The published list includes multiple R80 / R81 / R82 branches and various levels of Jumbo Hotfix Take; in addition Check Point confirmed that R82.20, standalone deployments (management and gateway on the same machine), Log Servers and Multi-Domain servers are also affected and require patch or support intervention if they are in off-support versions. Organizations that leave the management component directly exposed to the Internet or with the Trusted Customers configuration put to "any" are the most vulnerable.

How it works technically (summary): the Management Server login process processes applications before authenticating the user. A stack overflow in that routine can be triggered with a particularly long entry into the field of the user name. In a successful operation, the attacker could corrupt the stack and redirect the execution to get code with system privileges (root) on the remote server. Since the vector operates pre-authentication, the credentials requirement is avoided and the main restriction is which hosts can get to talk to that service - hence the relevance of the Trusted Customers parameter.

Possible real consequences (confirmed as technical scenarios, not as known incidents): an CERs as root in the Management Server allows to alter firewall policies, create or modify administrative accounts, extract or delete forensic log stored in Log Servers and, in environments where management and gateways are combined, directly compromise the traffic protected by the gateways. This can result in service interruption, loss of incident visibility and side climbing within the network.

Information still uncertain or estimates: there is no public evidence of functional exploits (Censys reported that there was no public PoC at the time of their notes) and Check Point / CISA claim to have no evidence of mass exploitation; however, it is not disposable that there is a private exploitation code or unreported abuse attempt. Censys also reported that it detects thousands of hosts that present the default identity of management servers (3,836 in its observation), but that is an estimated role presence and No. is equivalent to a confirmed count of vulnerable or outdated systems ( Censys).

Specific and immediate actions to be taken by managers (priority): 1) Apply the LivePatch described in sk1000155 to all Security Management Servers and Log Servers. If you have automatic updates enabled, do not assume protection: check that the LivePatch was installed and is active using the Check Point utility (e.g. the cplp list command to see LivePatches installed and its status). 2) Restringir Trusted Customers: confirm that the Trusted Customers list only contains IPs or explicit and reliable ranges; do not leave the option in "any" or allow access from the public Internet. 3) Avoid exposing Management Servers to the Internet: place administration access behind VPNs or jump hosts with access controls, and securely network so that only authorized management hosts can reach management servers.

Additional measures and good practices (recommended): immediate deployment of compensatory controls while applying the patch: block access to management services from unreliable networks, review and strengthen management policies, and require multi-factor authentication for accounts with administrative privileges. For versions that are out of support and do not receive automatic LivePatch, open a check point ticket to get the correction the company indicates you can supply.

What to review after applying the patch: audit recent administrative changes (created / altered policies), search for new or high administrative accounts, review connection logs and suspicious events in the previous days, check integrity of critical binaries and configuration backups, and monitor unusual traffic between Management Servers and gateways. In case of signs of engagement, isolate the affected server and contact the check point support and your incident response team.

On patch delivery and times: Check Point distributes critical corrections for its LivePatch channel and for Jumbos packages; however, the company has recognized that the delivery of automatic patches can be done in stages, so the absence of a patch in an installation does not imply a lack of one available - therefore the need to verify its installation explicitly.

Official sources and resources for immediate action: the check point knowledge base note with mitigation (sk1000155) and the CVE tab in NVD ( NVD - CVE-2026-91843) are starting points; for context on public exposure and scanning, see the work and public observations of Censys ( Censys). The list of vulnerabilities exploited by CISA should also be consulted to see if the situation is evolving ( CISA - Known Exploited Vulnerabilities).

Summary: Vulnerability is serious for allowing remote execution prior to authentication and for possible total control of the management server. Therefore, the immediate and verifiable action is to install the LivePatch in all Management and Log Servers, restrict Trusted Customers to known addresses and avoid any direct exposure to the Internet while completing the update and conducting a basic forensic verification. Confirmed or not the field holdings, the operational strategy must prioritise patching and hardening to close a vector that facilitates total control over network management.