**Critical Unauthenticated RCE Vulnerability Found in Check Point Security Management and Log Servers**
Check Point has disclosed a critical vulnerability affecting its Security Management and Log Servers. The flaw, tracked as CVE-2026-91843, carries a CVSS score of 9.8 out of 10 and allows an attacker to execute arbitrary code with root privileges over the network without needing any login credentials.
The vulnerability is a stack overflow occurring within the login process, which handles requests before a user is authenticated. According to independent scanning data, the overflow is triggered when a login request contains an excessively long username. The specific vulnerable path is tied to the Trusted Clients setting, which dictates which hosts are permitted to connect to the management server through the SmartConsole client.
**Affected Versions**
The vulnerability impacts several Check Point branches, identified by their Jumbo Hotfix Take levels. A server on a listed branch at the listed Take or an older one is at risk:
* R82.10 with Jumbo Hotfix Take 44 or below
* R82 with Jumbo Hotfix Take 126 or below
* R81.20 with Jumbo Hotfix Take 166 or below
* R81.10 with Jumbo Hotfix Take 190 or below, and R81, R80.40, R80.30, R80.20, R80.10, and R80, all of which are end-of-support
Although the official CVE record initially omitted R82.20, subsequent vendor confirmations indicate that every R82.20 build is vulnerable, and no Jumbo Hotfix currently protects that branch. Standalone deployments, Log Servers, and Multi-Domain servers are also confirmed vulnerable. However, the hosted Smart-1 Cloud service is not affected, as the fix is already deployed in that environment. For the out-of-support versions, the vendor has a fix ready and recommends customers log a support ticket to obtain it.
**What Administrators Should Do**
1. Apply the LivePatch fix described in advisory sk1000155 to every Security Management Server and Log Server.
2. If automatic updates are enabled, confirm the fix has been installed rather than assume it. The `cplp list` command shows which LivePatches are installed and their current status.
3. Whether or not the fix is installed, check that management Trusted Clients access is limited to known, trusted hosts and is not set to any IP address. Direct internet access to management should be avoided entirely, and a VPN is required for remote access.
It is important to note that LivePatch delivery is not always immediate. When urgent fixes are pushed, the rollout is often staged rather than delivered to all systems simultaneously. Additionally, the Trusted Clients setting is located in SmartConsole under Manage & Settings, Permissions & Administrators, Trusted Clients. The vendor emphasizes that the vulnerable path is only accessible through trusted clients, and management access should never be exposed directly to the internet.
**Conclusion**
CVE-2026-91843 represents a severe threat to network security infrastructure due to its high severity and ease of exploitation over the network without credentials. With the patch available via LivePatch, immediate action is required for on-premises deployments. Organizations must ensure their Trusted Clients are strictly limited to known hosts and that management interfaces are never exposed directly to the internet. While no exploitation has been reported yet, the high CVSS score and the recent history of critical flaws in this ecosystem demand urgent attention from all Check Point administrators.
**Frequently Asked Questions (FAQ)**
**Q: How exactly is the vulnerability triggered?**
**A:** The flaw is a stack overflow in the login process. It is triggered when a login request is sent with an excessively long username, which causes an overflow before the user has been authenticated.
**Q: What is the relationship between LivePatch and automatic updates?**
**A:** LivePatch is the specific channel used to push urgent security fixes to systems. Automatic updates are the general setting in SmartConsole that allows the system to download and install security updates and contracts. Having automatic updates enabled should pull in the LivePatch, but deployment can be staggered, so administrators should verify installation manually using the `cplp list` command.
**Q: Is the Smart-1 Cloud service affected by this vulnerability?**
**A:** No. The hosted Smart-1 Cloud service is not affected, as the necessary fix is already in place on the cloud infrastructure.
**Q: What should I do if I am running an end-of-support version like R81.10 or older?**
**A:** The vendor has prepared a fix for out-of-support versions. Customers running these older branches should log a support ticket with the vendor to obtain the necessary patch.
**Q: Has this vulnerability been exploited in the wild?**
**A:** As of the latest official assessments, there is no indication that CVE-2026-91843 has been exploited in the wild, and no public proof-of-concept exploit has been identified.
Thank you for reading
