Critical Check Point Management Server Flaw (CVE-2026-91843) Lets Unauthenticated Attackers Run Code as Root

Key facts

Detection coverage

As of 2026-09-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2557 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Check Point CVE-2026-91843 Oversized-Username Pre-Auth Overflow Trigger

Detects the vendor-published exploitation-attempt signature for CVE-2026-91843 -- a login request against a Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, or Multi-Domain Log Server carrying an oversized username, which overflows the stack in the unauthenticated login process (CWE-121) and can yield root code execution. Fires on the audit-log entry 'Administrator failed to log in: Username too long' and on repeated/incrementing-length login attempts from a single source consistent with exploit-trigger fuzzing against the CPMI login path gated by Trusted Clients.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1595.002
• Data sources: checkpoint_smartconsole_audit_log, checkpoint_syslog_cef_export, network_ids
• Severity: critical
• Confidence: high

Splunk SPL

index=checkpoint (sourcetype="checkpoint:syslog" OR sourcetype="cef:checkpoint" OR sourcetype="checkpoint:audit")
(msg="Administrator failed to log in: Username too long" OR reason="Username too long" OR cs1="Administrator failed to log in: Username too long")
| eval src_ip=coalesce(src_ip, src, cs4, orig)
| eval target_mgmt=coalesce(dest, dvc, dest_host)
| bin _time span=5m
| stats count as attempt_count, min(_time) as first_seen, max(_time) as last_seen, values(target_mgmt) as targeted_servers by src_ip, _time
| where attempt_count >= 1
| eval time_span_sec=last_seen-first_seen
| table _time, src_ip, targeted_servers, attempt_count, first_seen, last_seen, time_span_sec
| sort - attempt_count

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceVendor == "Check Point" and DeviceProduct has_any ("SmartConsole", "Security Management", "CPMI")
| where Message has "Administrator failed to log in: Username too long" or AdditionalExtensions has "Username too long" or Reason has "Username too long"
| summarize AttemptCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), TargetedServers = make_set(DestinationHostName) by SourceIP, bin(TimeGenerated, 5m)
| project TimeGenerated, SourceIP, TargetedServers, AttemptCount, FirstSeen, LastSeen
| sort by AttemptCount desc

Sigma

title: Check Point CVE-2026-91843 Oversized Username Pre-Auth Login Overflow Attempt
id: 6a1b7e2c-4d3f-4a8e-9c1b-2f5e8d7a3c91
status: experimental
description: Detects the audit-log signature for an attempted stack-based buffer overflow (CVE-2026-91843, CWE-121) in the unauthenticated login process of Check Point Security Management Server / Multi-Domain Security Management Server / Log Server / Multi-Domain Log Server, triggered by submitting an oversized username.
references:
  - https://support.checkpoint.com/results/sk/sk1000155
  - https://www.cve.org/CVERecord?id=CVE-2026-91843
  - https://thehackernews.com/2026/09/critical-check-point-management-server.html
author: Threadlinqs Team
date: 2026-09-18
tags:
  - attack.initial-access
  - attack.t1190
  - attack.reconnaissance
  - attack.t1595.002
  - cve.2026.91843
  - cwe.121
logsource:
  category: application
  product: checkpoint
  service: smartconsole_audit
detection:
  selection_msg:
    Message|contains: 'Administrator failed to log in: Username too long'
  selection_reason:
    Reason|contains: 'Username too long'
  condition: 1 of selection_*
falsepositives:
  - Legitimate admin fat-fingering an overlong username string without exploit intent (rare given SmartConsole client-side length limits)
  - Vulnerability scanner or authorized penetration test validating CVE-2026-91843 exposure
level: critical

Known false positives:

• A legitimate administrator mistyping or pasting an overlong string into the username field once, with no repeat attempts and no corresponding process crash on the management server

Tuning notes: Baseline the normal per-day count of failed logins from known admin source IPs first -- Trusted Clients restriction (per the vendor workaround) should make any hit from an untrusted source high-confidence. Tune the 5-minute bin and count threshold upward only if a specific automation tool is confirmed to generate benign 'Username too long' noise; correlate with a management-daemon (fwm/cpm) crash or restart event within the same window to separate a probing scan from a live overflow attempt.

• 🔒 Check Point CVE-2026-91843 Oversized-Username Pre-Auth Overflow Trigger · unlock with TL Creds
• 🔒 Check Point Management Daemon (fwm/cpm) Crash-Restart or Anomalous Child Process — Post-Exploitation Indicator · unlock with TL Creds
• 🔒 Compromised Security Management Server — Anomalous Topology/Credential Access, Internal Discovery, or Unauthorized Policy Push to Managed Gateways · unlock with TL Creds
• 🔒 Check Point CVE-2026-91843 Oversized-Username Pre-Auth Overflow Trigger · unlock with TL Creds
• 🔒 Check Point Management Daemon (fwm/cpm) Crash-Restart or Anomalous Child Process — Post-Exploitation Indicator · unlock with TL Creds
• 🔒 Compromised Security Management Server — Anomalous Topology/Credential Access, Internal Discovery, or Unauthorized Policy Push to Managed Gateways · unlock with TL Creds
• 🔒 Check Point Management Daemon (fwm/cpm) Crash-Restart or Anomalous Child Process — Post-Exploitation Indicator · unlock with TL Creds
• 🔒 Compromised Security Management Server — Anomalous Topology/Credential Access, Internal Discovery, or Unauthorized Policy Push to Managed Gateways · unlock with TL Creds

Indicators of compromise

As of 2026-09-18, Threadlinqs Intelligence tracks 18 indicators of compromise for TL-2026-2557.

Technical analysis

Check Point shipped a LivePatch fix for supported branches; End-of-Support branches (R81.10, R81, R80.x) have no fix.

On September 16, 2026, Check Point Software Technologies disclosed CVE-2026-91843 via security advisory sk1000155 and a companion community 'Action required' notification: a stack overflow (CWE-121) triggered during the unauthenticated login process of its Quantum Security Management line. The vulnerable code path is reached through the 'Trusted Clients' setting, which governs which hosts may open a management connection before credentials are ever validated. By submitting a login request carrying an excessively long username, a remote, unauthenticated attacker can overflow the stack and execute arbitrary code with root privileges on the Security Management Server, Multi-Domain Security Management Server, Log Server, or Multi-Domain Log Server. The vulnerability carries a CVSS v3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) -- network-reachable, low complexity, no privileges or user interaction required, and total impact to confidentiality, integrity, and availability.

Affected releases span the actively supported line -- R82.20 (all Jumbo Hotfix takes, no protection yet at disclosure), R82.10 through Jumbo Hotfix Take 44, R82 through Take 126, and R81.20 through Take 166 -- as well as End-of-Support branches R81.10 (through Take 190), R81, and the entire R80.x family, none of which receive a fix under normal support. Check Point's cloud-hosted Smart-1 Cloud offering is not affected; the vendor had already deployed the fix server-side. Remediation is delivered as LivePatch bundles (BUNDLE_URGENT_SECURITY_UPDATE): Take 29 for R82.20 and Take 28 for R82.10, R82, and R81.20, installable automatically via the automatic-updates channel or manually, with installation verified using the 'cplp list' command. Organizations on End-of-Support branches must open a support ticket for a fix or migrate to a supported release. As an interim compensating control, Check Point recommends restricting 'Trusted Clients' (SmartConsole > Manage & Settings > Permissions & Administrators > Trusted Clients) to specific administrator IP addresses rather than 'Any,' and hunting SmartConsole/audit logs for the signature 'Administrator failed to log in: Username too long,' which indicates an attempted overflow trigger.

As of publication (September 16-17, 2026) there is no confirmed in-the-wild exploitation and no public proof-of-concept; CISA records the exploitation status as 'none' and has not added CVE-2026-91843 to its Known Exploited Vulnerabilities catalog. However, Censys's internet-exposure advisory identified 3,836 globally distributed hosts presenting the default Check Point Security Internal Communication (SIC) identity 'cp_mgmt' used to fingerprint management-server roles -- a total role-presence count, not a confirmed-vulnerable count, but one that illustrates the scale of internet-facing exposure. Censys characterized the risk bluntly: a pre-auth RCE against network security management infrastructure tends to get weaponized fast once a working trigger is published. Because a Security Management Server holds full network topology, security policy, and third-party/directory/cloud integration credentials for every gateway it manages, per Check Point's own gateway-and-management hardening guidance, compromise of this single component would give an attacker the ability to view topology and stored credentials, and to push modified policy to every managed gateway -- including disabling enforcement or permitting unauthorized traffic.

CVE-2026-91843 is the fifth critical, unauthenticated Check Point management-plane vulnerability disclosed since July 2026, following CVE-2026-16232 (SmartConsole authentication bypass, actively exploited, added to CISA KEV July 22, 2026), CVE-2026-62144 (management-server authentication bypass enabling administrative command execution, disclosed the same day), CVE-2026-18574 (authentication bypass enabling command execution, disclosed August 3, 2026), and CVE-2026-85103 (heap overflow in VPN certificate decoding reaching Quantum Security Management, disclosed September 9, 2026) -- indicating a sustained pattern of attacker and researcher attention on Check Point's management infrastructure.

MITRE ATT&CK techniques by tactic:

Discovery

T1046 Network Service Discovery

Initial Access

T1190 Exploit Public-Facing Application

Collection

T1213 Data from Information Repositories

Impact

T1489 Service Stop; T1499.004 Application or System Exploitation

Credential Access

T1552 Unsecured Credentials

Resource Development

T1588.005 Exploits

Reconnaissance

T1592.002 Software; T1595.002 Vulnerability Scanning

defense-impairment

T1686 Disable or Modify System Firewall

Remediation

Patches

• LivePatch BUNDLE_URGENT_SECURITY_UPDATE Take 29 for R82.20
• LivePatch BUNDLE_URGENT_SECURITY_UPDATE Take 28 for R82.10
• LivePatch BUNDLE_URGENT_SECURITY_UPDATE Take 28 for R82
• LivePatch BUNDLE_URGENT_SECURITY_UPDATE Take 28 for R81.20
• End-of-Support branches (R81.10, R81, R80.40, R80.30, R80.20, R80.10, R80): fix obtainable only via a Check Point support ticket

Immediate actions

• Apply Check Point LivePatch BUNDLE_URGENT_SECURITY_UPDATE immediately on every Security Management Server, Multi-Domain Security Management Server, Log Server, and Multi-Domain Log Server (R82.20 Take 29; R82.10/R82/R81.20 Take 28), or confirm the automatic-updates channel already applied it
• Restrict SmartConsole 'Trusted Clients' (Manage & Settings > Permissions & Administrators > Trusted Clients) to specific known administrator IP addresses instead of 'Any' as a compensating control
• Hunt SmartConsole and audit logs for the entry 'Administrator failed to log in: Username too long,' which indicates an attempted exploitation trigger
• Verify installed patch level on every instance with the 'cplp list' command

Workarounds

• Restrict Trusted Clients to specific known administrator source IPs rather than 'Any'
• Monitor for the 'Administrator failed to log in: Username too long' audit-log signature as a detection proxy pending patching

Longer-term hardening

• Plan migration off End-of-Support branches (R81.10, R81, R80.40, R80.30, R80.20, R80.10, R80), which receive no vendor fix for this flaw under normal support
• Reduce internet exposure of Check Point management-plane interfaces (SIC/CPMI) identified via internet-scanning services such as Censys
• Enable the Check Point automatic-updates channel to receive future LivePatch fixes without manual intervention
• Review and rotate third-party, directory-service, and cloud-platform integration credentials stored on the Security Management Server given its central role over all managed gateways

Affected and fixed versions

• Check Point Software Technologies — Quantum Security Management Server / Multi-Domain Security Management Server / Log Server / Multi-Domain Log Server
  Vulnerable versions: R82.20 (all Jumbo Hotfix Takes); R82.10 (Jumbo Hotfix Take 44 or below); R82 (Jumbo Hotfix Take 126 or below); R81.20 (Jumbo Hotfix Take 166 or below); R81.10 (Jumbo Hotfix Take 190 or below, End of Support); R81 (End of Support); R80.40 (End of Support); R80.30 (End of Support); R80.20 (End of Support); R80.10 (End of Support)
  Fixed in: R82.20 with LivePatch Take 29; R82.10 with LivePatch Take 28; R82 with LivePatch Take 28; R81.20 with LivePatch Take 28
• Check Point Software Technologies — Smart-1 Cloud
  Fixed in: Fix already deployed server-side by the vendor; not affected

Timeline

• 2026-07-22 Check Point discloses CVE-2026-16232 (SmartConsole authentication bypass, CVSS 9.1-9.3) and CVE-2026-62144 (management-server authentication bypass enabling administrative command execution); CISA adds CVE-2026-16232 to its KEV catalog the same day, confirming active exploitation -- the first entries in the 2026 pattern of critical unauthenticated Check Point management-plane flaws.
• 2026-08-03 Check Point discloses CVE-2026-18574, an authentication bypass enabling command execution on the management server -- the third flaw in the 2026 pattern.
• 2026-09-09 Check Point discloses CVE-2026-85103, a heap overflow in VPN certificate decoding reaching Quantum Security Management -- the fourth flaw in the 2026 pattern.
• 2026-09-16 The Hacker News publishes coverage of CVE-2026-91843, noting it is the fifth critical unauthenticated Check Point management flaw disclosed since July 2026.
• 2026-09-16 Check Point publishes advisory sk1000155 and a community 'Action required' notification disclosing CVE-2026-91843 (CVSS 9.8), providing LivePatch fixes for R82.20, R82.10, R82, and R81.20.
• 2026-09-17 Additional security-media coverage (SecurityOnline, Cybersecurity News, threat.wiki) republishes technical detail and hunting guidance, emphasizing the 'Administrator failed to log in: Username too long' audit-log detection signature.
• 2026-09-17 NHS Digital issues UK healthcare-sector cyber alert cc-4854 referencing CVE-2026-91843.
• 2026-09-17 Censys publishes an advisory identifying 3,836 internet-exposed hosts globally presenting the Check Point 'cp_mgmt' Security Internal Communication identity (total role presence, not a confirmed-vulnerable count).
• 2026-09-17 CISA records the exploitation status of CVE-2026-91843 as 'none'; the CVE has not been added to the CISA Known Exploited Vulnerabilities catalog and no public proof-of-concept exists as of this date.

Sources cited

• Check Point advisory sk1000155 Check Point · Advisory · 2026-09-16
• CVE-2026-91843 CVE Record CVE Program · Advisory · 2026-09-16
• NVD CVE-2026-91843 Detail NVD (NIST) · Advisory · 2026-09-16
• NHS Digital cyber alert cc-4854 (CVE-2026-91843) digital.nhs.uk · Advisory · 2026-09-17
• [Important Notification] Action required - Critical Security Update (CVE-2026-91843) Check Point · Vendor report · 2026-09-16
• Sept. 16 Advisory: Check Point Quantum Security Management and Log Server Unauthenticated Login Stack Overflow [CVE-2026-91843] censys.com · Research · 2026-09-17
• CVE-2026-91843: Quantum Security Management Stack Buffer Overflow strix.ai · Research · 2026-09-17
• Check Point Security Management Server CVE-2026-91843: unauthenticated stack overflow in the login process threat.wiki · Blog · 2026-09-17
• Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root The Hacker News · News · 2026-09-16
• Check Point Vulnerability Lets Remote Hackers Gain Root Access Without Authentication cybersecuritynews.com · News · 2026-09-17
• Critical Check Point Login Flaw Enables Remote Takeover securityonline.info · News · 2026-09-17

More in vulnerability

• CISA ICSA-26-307-01: Critical Authorization Bypass (CVE-2026-63017) and SQL Injection (CVE-2026-63774) in Subnet Solutions PowerSYSTEM Center
• LNbits Operators Urged to Shut Down Bitcoin Lightning Wallet Servers Amid Active Attacks via Extension Exploit
• CISA adds four KEVs: GPUStack CVE-2026-102895, SignalWire FreeSwitch CVE-2026-116779, OpenBSD OpenSSH CVE-2026-123158, IBM Aspera Faspex CVE-2026-123218
• Able2Shell: 33 N-able N-central Vulnerabilities Chained into RCE and Root Privilege Escalation; N-able Takes Hosted Cloud Offline
• Windows Dangling COM Object Registration Local Privilege Escalation (CVE-2026-66804, incomplete fix for CVE-2026-50343 'Dark Elevator')

Other reports on CVE-2026-91843

• Eclypsium InfraTrust Report: Mass Active Exploitation of Network Management Systems (Cisco FMC/ISE CVE-2026-20079, CVE-2026-76460; SonicWall SMA 1000 CVE-2026-83548/83549; Linux Kernel CopyFail CVE-2026-31431)

Previous and next in vulnerability

• CISA KEV Catalog Addition: Active Exploitation of Cisco ISE Authentication Bypass (CVE-2026-76460) and Acronis Backup Privilege Escalation (CVE-2026-87886) Previous report
• AI-Driven Exploit Chain Against OpenAI Community Forum via libheif Flaw (CVE-2026-32882) Next report