Skip to content

Check Point Security Management Server CVE-2026-91843: unauthenticated stack overflow in the login process gives remote root (CVSS 9.8, Sep 16, 2026)

Summary

On September 16, 2026 Check Point published emergency security alert sk1000155 for CVE-2026-91843 (CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, vendor-scored by cve@checkpoint.com): a stack overflow during the unauthenticated login process may allow an attacker to run arbitrary code remotely with root privileges on the Security Management Server, Multi-Domain Security Management Server, Log Server, and Multi-Domain Log Server. The fix ships as an urgent LivePatch bundle — Check Point's emergency out-of-band channel, not a normal jumbo take — and the SK tells administrators to validate it with cplp list expecting a line reading fwm:fwm armed livepatch CVE-2026-91843. A public hunting tell is published in the advisory itself: SmartConsole Audit and Admin login logs containing "Administrator failed to log in: Username too long" — the overflow is reachable by simply sending an oversized username to the login path, before any credential check. The management server is the concentration point for firewall policy, administrator credentials, and topology across an entire fleet; compromise is equivalent to owning every gateway it governs. Smart-1 Cloud (Check Point's managed offering) is not affected — the fix was already implemented there. No exploitation in the wild had been reported at publication time, and no actor is named.

Tags

Vulnerability mechanics

  • Surface: the login process of Check Point management infrastructure — Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server. The overflow occurs during the login process, i.e. before authentication completes — no valid credentials required.
  • Primitive: a stack-based buffer overflow triggered during login handling. Check Point's own detection tell — the audit-log message "Administrator failed to log in: Username too long" — indicates the username field length is involved in the overflow path, so oversized login input to the management login protocol is the trigger.
  • Impact: arbitrary code execution as root on the management server. A management server holds administrator accounts, device credentials, full firewall/NAT/VPN policy, and push rights to every managed gateway — root there is fleet-wide compromise, and Log Server compromise means the attacker also controls the evidence stream.
  • Affected versions (per sk1000155, last modified 2026-09-16):
  • R82.20 (fix = urgent LivePatch take 29)
  • R82.10 Jumbo Hotfix Take ≤ 44 (take 28)
  • R82 Jumbo Hotfix Take ≤ 126 (take 28)
  • R81.20 Jumbo Hotfix Take ≤ 166 (take 28)
  • R81.10 Jumbo Hotfix Take ≤ 190 — EoS branch
  • R80.x and R81 (all EoS) — no LivePatch packages listed; these branches require migration
  • Not affected: Smart-1 Cloud environments.

Defender heuristics

  1. Install the urgent LivePatch now on every Security Management / Multi-Domain Security Management / Log Server — this is the emergency BUNDLE_URGENT_SECURITY_UPDATE_*_AUTOUPDATE channel; if automatic updates per sk175504 are enabled you are already protected, otherwise install the offline package for your branch.
  2. Validate deployment: run cplp list in Expert mode on each management/log server and confirm fwm:fwm armed livepatch CVE-2026-91843.
  3. Hunt the published tell: search SmartConsole Audit and Admin login logs for "Administrator failed to log in: Username too long" — single or repeated hits, especially from unexpected source addresses, are login-path probing (attempted or successful exploitation attempts look identical in this log until the server crashes or doesn't).
  4. Enforce Trusted Clients: confirm GUI-client trust lists are restricted to administrative subnets and never "Any" (Manage & Settings → Permissions & Administrators → Trusted Clients). This is Check Point's named interim mitigation and it removes the unauthenticated network path to the login process for anyone outside the trust list.
  5. Follow the hardening guide for management-plane reachability: the Gateway and Management Hardening Administration Guide exists precisely because this interface was never meant to be internet-reachable; audit any management IP exposed outside the admin network.
  6. Assume credential rotation on suspicion: if you find probing or crashes consistent with exploitation, treat administrator accounts and every managed-device credential the server stores as exposed — rotate at the source, not just in SmartConsole.
  7. EoS branches are the hard problem: R81.10/R81/R80.x are end-of-support with no LivePatch listed. Organizations still on them have no vendor fix path and must compensate with network-level restriction of the management interface immediately, and upgrade as the real fix.
  8. Pattern read: this is the third September 2026 security-management-plane root flaw in the public record — Cisco Secure FMC CVE-2026-20079 (KEV, three actor clusters per Talos) and Cisco Secure Email Gateway CVE-2026-76461 (KEV, cloud-fleet exploitation observed) came first. Management and filtering appliances are being treated as the soft path to whole fleets. Update (Sep 16, later same day): Cisco ISE CVE-2026-76460 (CVSS 10.0, unauthenticated management-interface bypass, vendor-confirmed active exploitation) was KEV-listed the same day — the fourth September management-plane root-class flaw — while 91843 itself is not yet in KEV (catalog 2026.09.16, 1,713 entries; watch for a listing, especially given ISE's listing landed within hours of the advisory). See CISA KEV September 16 batch page.

Sources