# Critical Check Point Management Server Flaw (CVE-2026-91843) Lets Unauthenticated Attackers Run Code as Root

> An unauthenticated stack-based buffer overflow (CVE-2026-91843, CVSS 9.8, CWE-121) in the login process of Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, and Multi-Domain Log Server lets a remote attacker send an oversized username to gain root code execution before authentication completes. Check Point shipped a LivePatch fix for supported branches; End-of-Support branches (R81.10, R81, R80.x) have no fix.

- **Published:** 2026-09-18T00:00:00Z
- **Last reviewed:** 2026-09-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2557
- **ID:** TL-2026-2557
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-91843

## Description

On September 16, 2026, Check Point Software Technologies disclosed CVE-2026-91843 via security advisory sk1000155 and a companion community 'Action required' notification: a stack overflow (CWE-121) triggered during the unauthenticated login process of its Quantum Security Management line. The vulnerable code path is reached through the 'Trusted Clients' setting, which governs which hosts may open a management connection before credentials are ever validated. By submitting a login request carrying an excessively long username, a remote, unauthenticated attacker can overflow the stack and execute arbitrary code with root privileges on the Security Management Server, Multi-Domain Security Management Server, Log Server, or Multi-Domain Log Server. The vulnerability carries a CVSS v3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) -- network-reachable, low complexity, no privileges or user interaction required, and total impact to confidentiality, integrity, and availability.

Affected releases span the actively supported line -- R82.20 (all Jumbo Hotfix takes, no protection yet at disclosure), R82.10 through Jumbo Hotfix Take 44, R82 through Take 126, and R81.20 through Take 166 -- as well as End-of-Support branches R81.10 (through Take 190), R81, and the entire R80.x family, none of which receive a fix under normal support. Check Point's cloud-hosted Smart-1 Cloud offering is not affected; the vendor had already deployed the fix server-side. Remediation is delivered as LivePatch bundles (BUNDLE_URGENT_SECURITY_UPDATE): Take 29 for R82.20 and Take 28 for R82.10, R82, and R81.20, installable automatically via the automatic-updates channel or manually, with installation verified using the 'cplp list' command. Organizations on End-of-Support branches must open a support ticket for a fix or migrate to a supported release. As an interim compensating control, Check Point recommends restricting 'Trusted Clients' (SmartConsole > Manage & Settings > Permissions & Administrators > Trusted Clients) to specific administrator IP addresses rather than 'Any,' and hunting SmartConsole/audit logs for the signature 'Administrator failed to log in: Username too long,' which indicates an attempted overflow trigger.

As of publication (September 16-17, 2026) there is no confirmed in-the-wild exploitation and no public proof-of-concept; CISA records the exploitation status as 'none' and has not added CVE-2026-91843 to its Known Exploited Vulnerabilities catalog. However, Censys's internet-exposure advisory identified 3,836 globally distributed hosts presenting the default Check Point Security Internal Communication (SIC) identity 'cp_mgmt' used to fingerprint management-server roles -- a total role-presence count, not a confirmed-vulnerable count, but one that illustrates the scale of internet-facing exposure. Censys characterized the risk bluntly: a pre-auth RCE against network security management infrastructure tends to get weaponized fast once a working trigger is published. Because a Security Management Server holds full network topology, security policy, and third-party/directory/cloud integration credentials for every gateway it manages, per Check Point's own gateway-and-management hardening guidance, compromise of this single component would give an attacker the ability to view topology and stored credentials, and to push modified policy to every managed gateway -- including disabling enforcement or permitting unauthorized traffic.

CVE-2026-91843 is the fifth critical, unauthenticated Check Point management-plane vulnerability disclosed since July 2026, following CVE-2026-16232 (SmartConsole authentication bypass, actively exploited, added to CISA KEV July 22, 2026), CVE-2026-62144 (management-server authentication bypass enabling administrative command execution, disclosed the same day), CVE-2026-18574 (authentication bypass enabling command execution, disclosed August 3, 2026), and CVE-2026-85103 (heap overflow in VPN certificate decoding reaching Quantum Security Management, disclosed September 9, 2026) -- indicating a sustained pattern of attacker and researcher attention on Check Point's management infrastructure.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1592.002 Software
- T1588.005 Exploits
- T1190 Exploit Public-Facing Application
- T1046 Network Service Discovery
- T1552 Unsecured Credentials
- T1686 Disable or Modify System Firewall
- T1213 Data from Information Repositories
- T1499.004 Application or System Exploitation
- T1489 Service Stop

## Sources

- [Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root](https://thehackernews.com/2026/09/critical-check-point-management-server.html)
- [Check Point advisory sk1000155](https://support.checkpoint.com/results/sk/sk1000155)
- [CVE-2026-91843 CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-91843)
- [NVD CVE-2026-91843 Detail](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-91843)
- [Important Notification Action required - Critical Security Update (CVE-2026-91843)](https://community.checkpoint.com/t5/General-Topics/Important-Notification-Action-required-Critical-Security-Update/m-p/282409)
- [Sept. 16 Advisory: Check Point Quantum Security Management and Log Server Unauthenticated Login Stack Overflow CVE-2026-91843](https://censys.com/advisory/cve-2026-91843/)
- [CVE-2026-91843: Quantum Security Management Stack Buffer Overflow](https://www.strix.ai/cve/CVE-2026-91843)
- [Check Point Vulnerability Lets Remote Hackers Gain Root Access Without Authentication](https://cybersecuritynews.com/check-point-root-access-flaw/)
- [Critical Check Point Login Flaw Enables Remote Takeover](https://securityonline.info/check-point-login-flaw-cve-2026-91843/)
- [Check Point Security Management Server CVE-2026-91843: unauthenticated stack overflow in the login process](https://threat.wiki/tools/check-point-security-management-server-cve-2026-91843-login-stack-overflow-root-rce-september-2026/)
- [NHS Digital cyber alert cc-4854 (CVE-2026-91843)](https://digital.nhs.uk/cyber-alerts/2026/cc-4854)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2557