- The Mess: Check Point patched a critical stack-based buffer overflow in the unauthenticated login process of its Security Management and Log Servers. No credentials are required, and successful exploitation can lead to arbitrary code execution with root privileges.
- The Damage: The vulnerable machine is the management layer controlling security infrastructure — compromise it and the attacker is sitting on one of the most privileged systems in the environment.
- The Fix: Apply Check Point’s LivePatch/security update immediately and verify the installed Jumbo Hotfix level against the affected versions.
The login process is the attack surface
The vulnerability is tracked as CVE-2026-91843.
Check Point describes it as a stack overflow during the unauthenticated login process. The CVE record assigns it CVSS 9.8, with the vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
That is the nasty combination:
- network reachable
- low attack complexity
- no privileges
- no user interaction
- high confidentiality impact
- high integrity impact
- high availability impact
In plain English: an attacker does not need an account before reaching the vulnerable code.
And the vulnerable component is not some obscure desktop utility.
It sits inside the Security Management and Log Server stack.
Root is the prize
The vendor’s description is brutally short: exploitation of the stack overflow may allow an unauthenticated attacker to run arbitrary code remotely with root privileges.
That changes the impact considerably.
A compromised endpoint is bad.
A compromised web server is worse.
A compromised security management server is a different problem entirely.
Management infrastructure commonly sits in a privileged position relative to the rest of the security architecture. It can contain policy information, logging data, certificates, credentials and configuration used to operate security controls.
The CVE itself does not mean every Check Point deployment automatically exposes all of those assets to an attacker. The actual blast radius depends on architecture, network exposure, credentials and connected systems.
But the initial foothold is particularly attractive because the vulnerable service is part of the management plane.
What is actually affected?
The CVE record lists these affected Quantum Security Management versions:
- R82.10 with Jumbo Hotfix Take 44 or earlier
- R82 with Jumbo Hotfix Take 126 or earlier
- R81.20 with Jumbo Hotfix Take 166 or earlier
- R81.10, end-of-support, with Jumbo Hotfix Take 190 or earlier
- older R81/R80.x releases that are already end-of-support
The Canadian Centre for Cyber Security independently lists the affected R81.20, R82 and R82.10 branches and specifically calls out R82.20 in its advisory. Administrators should therefore use Check Point’s own SK1000155 guidance for the exact remediation path rather than trying to infer safety from the major version alone.
This is not a firewall data-plane bug
That’s an important distinction.
The vulnerable products are:
- Security Management Server
- Multi-Domain Security Management Server
- Log Server
- Multi-Domain Log Server
The problem is in the login process of the management/logging infrastructure.
So an organisation can have a perfectly hardened firewall cluster and still have a serious vulnerability sitting in the server used to manage that cluster.
Security teams sometimes concentrate on the appliance that handles traffic and forget about the management infrastructure behind it.
Attackers don’t have that luxury.
They look for the weakest exposed management interface.
No authentication required
The CVSS vector gives the key detail:
PR:N
Privileges Required: None.
That means the attacker does not first need a valid Check Point administrator account.
The attack also requires no victim interaction:
UI:N
And the vulnerable service is network reachable:
AV:N
This is why Check Point issued an urgent notification rather than treating the issue as a routine plugin-level bug.
Is it already being exploited?
As of the latest vendor advisory available for this article, Check Point says there is no indication that CVE-2026-91843 has been exploited in the wild. It also recommends immediate remediation because of the vulnerability’s severity and potential impact.
Current public vulnerability tracking likewise does not list it in CISA KEV.
That’s important because a CVSS 9.8 is not the same thing as confirmed active exploitation.
Right now the facts are:
Critical vulnerability: yes.
Unauthenticated remote exploitation: possible according to vendor description.
Root code execution: possible according to vendor description.
Public exploitation confirmed: not currently established.
CISA KEV: not currently listed.
That distinction should survive publication.
Check Point has a LivePatch path
Check Point’s own security notification points customers toward SK1000155 and says to apply the LivePatch fix. Customers with automatic updates enabled are already protected, according to Check Point.
This matters because management servers are often sensitive infrastructure that administrators don’t want to reboot casually in the middle of a production window.
LivePatch gives Check Point customers a way to apply the security correction without treating the management plane like an ordinary application server.
But “automatic updates enabled” should not become an excuse to do nothing.
Verify.
Don’t assume.
Check the actual Jumbo Hotfix level
The affected-version information is tied to Jumbo Hotfix Take numbers, not just the product’s major release.
For example:
R82 + JHF Take 126 or earlier
is affected.
That means simply knowing “we run R82” is insufficient.
The same applies to R81.20 and R82.10.
Administrators should verify the actual installed build and hotfix level, then compare it with Check Point’s SK1000155 remediation instructions.
This is especially important for older systems because several affected branches are already end-of-support.
What should administrators do?
1. Identify every affected management and logging server.
Don’t check only the primary Security Management Server. Multi-Domain and Log Server installations also matter.
2. Check the Jumbo Hotfix level.
Record the exact Take number.
3. Apply Check Point’s LivePatch/security update.
Use the vendor remediation procedure rather than installing an unrelated Jumbo Hotfix and assuming the issue disappeared.
4. Review external exposure.
Management interfaces should not be casually exposed to the public Internet.
Reducing exposure is not a replacement for patching, but it removes an unnecessary attack path.
5. Review authentication and management logs.
Look for unusual login-process activity, unexpected administrative connections and configuration changes around the time of suspicious network traffic.
6. Treat an exposed vulnerable server as high priority.
The lack of confirmed exploitation does not make a pre-auth root RCE harmless.
Why this one matters
The interesting part of CVE-2026-91843 isn’t just the number 9.8.
It’s the combination:
Internet / network
↓
Unauthenticated login process
↓
Stack overflow
↓
Remote code execution
↓
root
↓
Security Management / Log Server
There is no credential theft step.
No phishing.
No malicious document.
No user clicking anything.
No compromised endpoint required as the first step.
The vulnerability sits directly in the authentication boundary.
Bugstoday’s take
Security management servers are supposed to be the systems you trust more, not less.
CVE-2026-91843 flips that relationship.
An unauthenticated attacker can potentially reach the login process, trigger a stack overflow and execute code as root on a system that belongs to the management plane.
There is currently no vendor indication of active exploitation. Good.
That doesn’t make the patch optional.
The best time to fix a pre-auth root RCE in security infrastructure is before somebody turns the advisory into a working exploit.
Patch the management server. Then check it again.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
- Check Point — Security Notification SK1000155 / CVE-2026-91843
- CVE Record — CVE-2026-91843
- Canadian Centre for Cyber Security — AV26-933
- Check Point CheckMates — official security notification
- NVD — CVE-2026-91843
