Check Point has patched a severe security flaw—CVE-2026-91843—that allows unauthenticated remote attackers to execute arbitrary code with root privileges on certain management and logging systems. The issue is a stack-based buffer overflow triggered by an overly long username during login, before authentication can succeed.
This vulnerability carries a CVSS 3.1 score of 9.8, signaling its extreme severity. It requires zero credentials, imposes very low complexity, and demands no user interaction—making it immediately exploitable across affected Check Point environments.
Affected Systems and Exposure Risks
The flaw impacts several Check Point products, including Security Management Server, Multi-Domain Security Management Server, Log Server, and Multi-Domain Log Server. Vulnerable software versions include R82.20 (all takes prior to patch), R82.10 up to Jumbo Hotfix Take 44, R82 (Take 126 or earlier), R81.20 up to Take 166, and end-of-support R81.10 through earlier takes. Lesser versions like R80 through R80.40 and R81 also remain exposed.
Smart-1 Cloud deployments are safe, as fixes have already been pushed to those platforms. For others, root access from a remote attacker could yield full control over operating system functions, disclosure of administrative credentials, security policies, collected logs, and potential lateral movement inside affected networks.
Mitigation and Detection Steps
Administrators should immediately apply the patch—supplied via Check Point LivePatch (under sk175504) or offline Take updates (e.g. Take 29 for R82.20; Take 28 for R82.10, R82, and R81.20). Once installed, validation involves checking each server in Expert mode: the command cplp list should show the fwm:fwm patch in “armed” status, in “livepatch” mode, with CVE-2026-91843 mentioned in the comment field.
Until full remediation is confirmed, it’s advised to restrict SmartConsole Trusted Clients to known IPs or subnets via the Permissions & Administrators settings, avoiding overly broad settings like “Any” for client trust. Furthermore, logs should be monitored for messages stating “Administrator failed to log in: Username too long,” which could flag exploit attempts. Capture relevant sources, timestamps, administrative activities, and any anomalous system processes for forensic investigation.
Check Point emphasizes that using unsupported releases increases risk dramatically. Migration to supported branches is strongly urged as a priority—but this is no substitute for applying the urgent security fix now.
Analytically, this flaw stands out as a “pre-authentication” remote root exploit—a rare but deeply impactful class of vulnerability. Such bugs demand not only swift patching but proactive hunting for exploit traces. Any organization running vulnerable Check Point management or log servers should be treating this as a red-alarm situation. Watch for unexpected entries like overly long usernames, unusual login failures, and any deviations in system stats or privileges. Failure to act could expose entire environments to takeover without warning.
