Stack overflow in login handler allows unauthenticated RCE as root
Stack overflow in Check Point Security Management Server login handler allows unauthenticated RCE as root. CVSS 9.8. Patch available via sk1000155.
- Vendor
- Check Point
- Product
- Security Management Server, Log Server, Multi-Domain Server
- CVSS
- 9.8
- EPSS (exploit probability)
- 0.5%
- Status
- patched
- Published
Is CVE-2026-91843 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-91843 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-05 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.5% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-05. Full cross-catalog view: /kev-comparison
CVE-2026-91843 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
A stack overflow in the Check Point Security Management Server login process allows unauthenticated remote attackers to execute arbitrary code as root. The flaw requires no credentials and is reachable over the network.
Affected versions: R82.20 (all builds), R82.10 through Jumbo Hotfix Take 44, R82 through Take 126, R81.20 through Take 166, R81.10 through Take 190, and all end-of-support releases (R81, R80.40, R80.30, R80.20, R80.10, R80). Log Servers, Multi-Domain Servers, and standalone deployments are also affected.
Exploitation status: No active exploitation confirmed as of September 17, 2026. No public PoC. Not listed on the CISA Known Exploited Vulnerabilities catalog.
Patch: LivePatch via sk1000155. Systems with automatic updates enabled are already protected. End-of-support versions require a Check Point support ticket for a backport.
Structural note: Check Point’s advisory specifies the attack routes through the management API. The Trusted Clients setting limits which hosts can connect to that API.
Other Check Point CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-93616 Check Point Multiple Products Path Traversal Vulnerabilitywrite-up | [ CRITICAL ] | 9.8 | 91.6% | |
| CVE-2026-85102 Unauthenticated RCE via VPN certificate handling in Check Point productswrite-up | [ CRITICAL ] | 9.8 | 54.1% | |
| CVE-2026-85103 Unauthenticated RCE via VPN certificate handling in Check Point productswrite-up | [ CRITICAL ] | 9.8 | 4.3% | — |
| CVE-2026-16232 Check Point SmartConsole improper authenticationwrite-up | [ CRITICAL ] | 9.1 | 3.5% | |
| CVE-2026-50751 Check Point Security Gateway Improper Authentication Vulnerabilityransomware use | [ CRITICAL ] | 9.3 | 85.3% | |
| CVE-2024-24919 Check Point Quantum Security Gateways Information Disclosure Vulnerabilityransomware use | [ HIGH ] | 8.6 | 100.0% |
