Check Point Says Every Security Management Server Is Open to Unauthenticated Root Attacks

Check Point says a stack overflow in the unauthenticated login path can give an attacker root on every on-prem Security Management Server.

SecureKnowledge advisory sk1000155, dated 16 September 2026, tracks the bug as CVE-2026-91843 and assigns a CVSS score of 9.8. The vendor has not flagged the CVE as already in active use.

The overflow sits in the login process on Security Management Server, Multi-Domain Security Management Server, Log Server, and Multi-Domain Log Server. A successful attack gives unauthenticated remote code execution as root, with low complexity and no user interaction, BleepingComputer reported. Check Point said all Security Management Server deployments are vulnerable regardless of configuration, including when VPN is not in use.

Smart-1 Cloud is listed as not affected because the fix is already in that environment. The official fix is Check Point LivePatch Take 29 or later for R82.20, and LivePatch Take 28 or later for R82.10, R82, and R81.20. End-of-support R81.x and R80.x branches are told to move to a supported release. After install, Expert mode cplp list should show fwm armed for CVE-2026-91843.

Until the take lands, Check Point's temporary mitigation is to restrict Trusted Clients in SmartConsole (Manage and Settings, Permissions and Administrators, Trusted Clients) to trusted IPs or subnets, and not leave Client Type set to Any. Detection in Audit and Admin login logs is the string "Administrator failed to log in: Username too long."

The advisory is a different bug from last week's CVE-2026-85102 and CVE-2026-85103, and from earlier auth-bypass zero-days that Qilin abused.

Some offers on this page may be paid placements or contain affiliate links.