Check Point CVE-2026-91843: Patch the Management and Log Server Root RCE

By AiCybr Editorial · Published September 18, 2026

Check Point has released a LivePatch for CVE-2026-91843, a CVSS 9.8 stack-overflow vulnerability in the unauthenticated login process of its Security Management and Log Server products. Successful exploitation can allow a remote attacker to execute arbitrary code with root privileges.

The affected products include Security Management Server, Multi-Domain Security Management Server, Log Server and Multi-Domain Log Server. Check Point disclosed the issue on September 16, 2026 and says customers with automatic updates enabled are already protected by the LivePatch. Administrators should verify the patch state on every management and log server rather than treating the update setting itself as deployment evidence.

Check Point says it has no indication of exploitation in the wild at disclosure. The vulnerability is nevertheless an urgent management-plane patch because the CVSS vector is network-accessible, requires no privileges or user interaction, and successful exploitation reaches root.

Affected releases

Check Point and national cybersecurity advisories identify the following affected release families and Jumbo Hotfix boundaries:

Smart-1 Cloud is already protected because Check Point has applied the fix in the hosted environment.

CERT-FR additionally lists the relevant LivePatch package takes as R82.20 Take 29, R82.10 Take 28, R82 Take 28 and R81.20 Take 28 for affected Security Management and Log Server roles. Administrators should use Check Point advisory sk1000155 as the authoritative package source for their exact deployment.

Why CVE-2026-91843 is critical

CVE-2026-91843 is classified as CWE-121, stack-based buffer overflow. Its CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

That combination describes a network attack with low complexity, no required account and no user interaction, with high confidentiality, integrity and availability impact. Check Point's description places the vulnerable condition in the login process before authentication and states that arbitrary code can execute with root privileges.

Management servers are particularly sensitive because they hold the administrative control plane for managed security infrastructure. A successful root-level compromise therefore warrants investigation of administrative activity, policy integrity and connected management systems in addition to patch deployment.

Apply and verify the LivePatch

Check Point's primary remediation is the LivePatch distributed under sk1000155. Automatic-update customers should receive the protection automatically; manual/offline LivePatch packages are available for supported releases.

After deployment, use Expert mode on each affected management or log server and run:

cplp list

Check Point's verification guidance expects the CVE-specific protection to appear as an armed LivePatch for the fwm process. Record the output with the server inventory so the organization has evidence that the protection is active on every relevant node.

For end-of-support branches, use Check Point's current support guidance to determine the supported upgrade or remediation path. Long-term remediation should move management infrastructure onto a supported release even where an exceptional fix is available.

Restrict Trusted Clients

Check Point also recommends tightening Trusted Clients, which controls the hosts allowed to connect to the management server with SmartConsole. Define known administrative IP addresses or subnets and remove unnecessarily broad access such as Any.

This restriction reduces the network population able to reach the vulnerable login surface. It complements the LivePatch and remains useful management-plane hardening after patching.

Management interfaces should also follow Check Point's hardening guidance: keep administrative access on controlled networks or through an approved VPN path and avoid direct public-internet exposure.

Hunt for attempted exploitation

Check Point provides a concrete log-search indicator for this vulnerability. In SmartConsole, review Audit and Admin login logs for:

Administrator failed to log in: Username too long

CERT-FR repeats this indicator in its September 17 advisory. A matching event can indicate an attempt to trigger the oversized-input condition and should be investigated with surrounding source-address, authentication and administrative telemetry.

The indicator is useful for triage, while absence of that log entry alone cannot establish that a server was never targeted. Organizations with exposed or broadly reachable management services should correlate Check Point logs with firewall, VPN, network-flow and centralized logging data.

Remediation checklist

1. Inventory Security Management, Multi-Domain Security Management, Log and Multi-Domain Log Servers.
2. Identify the installed release and Jumbo Hotfix Take for every node.
3. Apply the CVE-2026-91843 LivePatch from Check Point sk1000155 to every affected server.
4. Run cplp list and confirm that the CVE-specific LivePatch is installed and armed.
5. Restrict Trusted Clients to known administrative hosts or networks.
6. Search Audit and Admin login logs for Administrator failed to log in: Username too long.
7. Investigate suspicious events using external network and centralized logging telemetry.
8. Plan migration from affected end-of-support R80/R81 branches to a supported release.

Evidence and exploitation status

Check Point's September 16 notification states that it had no indication CVE-2026-91843 had been exploited in the wild at the time of disclosure. Current advisories from CERT-FR, the Canadian Centre for Cyber Security and NHS England corroborate the affected management/log-server scope and urgent patch guidance.

The public advisory establishes the pre-authentication root-code-execution impact and patch path. It does not establish an active exploitation campaign, so incident-response claims should be based on local evidence or a subsequent vendor/government exploitation update.

Bottom line

CVE-2026-91843 puts Check Point's management plane at risk of unauthenticated remote root code execution. Apply the sk1000155 LivePatch across every affected Security Management and Log Server, verify the armed patch with cplp list, restrict Trusted Clients, and search for the vendor-provided oversized-username indicator. Smart-1 Cloud is already protected; self-managed deployments require administrator verification.

Sources

• Check Point, sk1000155: https://support.checkpoint.com/results/sk/sk1000155
• Check Point CheckMates security notification: https://community.checkpoint.com/t5/General-Topics/Important-Notification-Action-required-Critical-Security-Update/m-p/282409/highlight/true
• CERT-FR advisory CERTFR-2026-AVI-1193: https://cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1193/
• Canadian Centre for Cyber Security AV26-933: https://www.cyber.gc.ca/en/alerts-advisories/check-point-security-advisory-av26-933
• NHS England Digital CC-4854: https://digital.nhs.uk/cyber-alerts/2026/cc-4854