CVE-2026-91843: Check Point Management Server RCE

A stack overflow in the login handler of Check Point Security Management Server, Log Servers, and Multi-Domain deployments allows unauthenticated remote attackers to execute code as root. CVE-2026-91843. CVSS 9.8. Critical.

Check Point disclosed the flaw on September 16, 2026, alongside advisory sk1000155 and a LivePatch fix. No active exploitation confirmed as of September 17. No public proof-of-concept. Not on the CISA Known Exploited Vulnerabilities catalog.

Affected builds

Security Management Server, Log Server, Multi-Domain Server, and standalone deployments are all in scope.

Vulnerable versions:

• R82.20 (all builds)
• R82.10 through Jumbo Hotfix Take 44
• R82 through Take 126
• R81.20 through Take 166
• R81.10 through Take 190
• R81, R80.40, R80.30, R80.20, R80.10, R80 (end-of-support; backports via Check Point support ticket)

The flaw

The login process fails to bound username length. A crafted request carrying an oversized username overflows the stack, yielding arbitrary code execution as root with no credentials required.

Check Point’s advisory notes one structural constraint: the attack routes through the management API, and the Trusted Clients setting governs which hosts can reach it. Environments restricting that access to named management workstations have a smaller exposure window on this vector.

Patch

LivePatch via sk1000155. Systems with automatic updates enabled are already protected. Environments on end-of-support versions (R81 and earlier) receive a backport through Check Point’s support portal.

Check Point’s community notice covers the same disclosure without a portal login.

Related coverage

Check Point issued two CVSS 9.8 VPN RCE patches on September 11 (CVE-2026-85102, CVE-2026-85103); the Dutch NCSC followed with an imminent-exploitation advisory two days later. CVE-2026-91843 is a separate product line (management plane, not VPN), separate CVE, and separate patch cycle.