A critical vulnerability in Check Point's Security Management and Log Servers could allow an attacker without login credentials to run code as root on those servers over the network.
The Security Management Server is the system that controls firewall policy and administrator access. Check Point has released a fix through its LivePatch update channel and says it has no indication that the flaw has been exploited.
Check Point told The Hacker News that the vulnerable path runs only through the Trusted Clients setting, which controls which hosts may connect to the management server through SmartConsole.
The flaw, tracked as CVE-2026-91843 and rated 9.8 out of 10 on the CVSS scale by Check Point, is a stack overflow in the login process, which handles requests before a user is authenticated. Internet scanning company Censys said the overflow is triggered by a login request that carries a very long username.
Check Point said in a notice on its CheckMates community on September 16, 2026, that customers with automatic updates enabled are already protected, and that everyone else should apply the LivePatch fix described in advisory sk1000155. It urged customers to take immediate action because of the flaw's severity and potential impact.
"At this time, there is no indication that this vulnerability has been exploited in the wild," the notice said. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recorded exploitation as "none" in its assessment attached to the CVE record on September 17.
The flaw was not in CISA's Known Exploited Vulnerabilities catalog as of the catalog's September 16 release, which The Hacker News checked on September 17. Censys said no public proof-of-concept exploit existed as of September 16. Aviv Abramovich, vice president of product management for network security at Check Point, told The Hacker News that the company had not received any reports of exploitation.
Affected Versions
Check Point's CVE record lists the following branches as affected, by Jumbo Hotfix Take, the numbered level of the update package that collects the fixes for a release.
A server on a listed branch at the listed Take or an older one is affected.
- R82.10 with Jumbo Hotfix Take 44 or below
- R82 with Jumbo Hotfix Take 126 or below
- R81.20 with Jumbo Hotfix Take 166 or below
- R81.10 with Jumbo Hotfix Take 190 or below, and R81, R80.40, R80.30, R80.20, R80.10 and R80, all of which are end of support
The record does not list R82.20, but Abramovich said R82.20 is also vulnerable. Censys said in its advisory that every R82.20 build is affected and that no Jumbo Hotfix yet protects that branch.
Standalone deployments, which run management and gateway on one system, Log Servers and Multi-Domain servers are also vulnerable, Abramovich said. An alert from NHS England Digital, citing sk1000155, says the hosted Smart-1 Cloud service is not affected because the fix is already in place there.
The CVE record marks R81.10 and the older branches as end-of-support. Check Point has a fix ready for those out-of-support versions, Abramovich said, and customers who need it should log a ticket with Check Point support.
What Administrators Should Do
- Apply the LivePatch fix described in sk1000155 to every Security Management Server and Log Server.
- If automatic updates are enabled, confirm the fix has been installed rather than assume it. The cplp list command shows which LivePatches are installed and their status.
- Whether or not the fix is installed, check that management Trusted Clients access is limited to known, trusted hosts and is not set to any IP address, and do not expose management access directly to the internet.
"Automatic updates" means the setting described in sk175504, according to Check Point's hardening guide. It is the checkbox in SmartConsole, under Global Properties and Data Access Control, labeled "Automatically download and install Software Blade Contracts, security updates, and other important data (highly recommended)," followed by the installation of the Access Control policy. LivePatch is the channel Check Point uses to push urgent security fixes to systems where that option is turned on.
Delivery is not always immediate. When Check Point pushed fixes for two VPN certificate flaws last week, several customers wrote in its community that the automatic package had not reached their systems on the day of the announcement, and a Check Point community admin replied that it was presumably being rolled out in stages rather than to everyone at once. Customers also found that the download links in those advisories appeared only after signing in to the User Center.
The Trusted Clients setting is in SmartConsole under Manage & Settings, Permissions & Administrators, Trusted Clients, according to the hardening guide, which also says that direct internet access to management should be avoided and that a VPN is required. The vulnerable path is "only through trusted clients," Abramovich said, and Check Point recommends that customers verify the setting is not set to any IP address but to trusted hosts.
Censys said it observes 3,836 hosts worldwide that present the default identity Check Point gives its management and log servers, a method it chose because build and hotfix level are not visible in scan data. "This figure is total role presence, not a confirmed-vulnerable count," the company said.
Fifth Critical Management Flaw Since July
By The Hacker News' count of Check Point's CVE records, CVE-2026-91843 is the fifth critical flaw since July 22 that an attacker could reach on the Security Management Server without logging in.
The first, CVE-2026-16232, a SmartConsole authentication bypass, was exploited in July. Check Point's Lotem Finkelstein wrote then that it affected "a handful of customers" in one configuration, "when Management is exposed directly to the internet without IP restrictions." The first mitigation step then was the one recommended now: limit Trusted Clients to trusted addresses.
CISA added CVE-2026-16232 to its Known Exploited Vulnerabilities catalog the same day. A second management bypass disclosed that day, CVE-2026-62144, was not reported as exploited.
Two more followed: CVE-2026-18574, an authentication bypass that could allow command execution on the management server, on August 3, and CVE-2026-85103, a heap overflow in VPN certificate decoding that also reaches Quantum Security Management, on September 9. Check Point said it found both internally and had no indication of exploitation.
Who found CVE-2026-91843 has not been disclosed, and Check Point did not address that question in its response.
Update: This article was updated on September 18, 2026, with responses from Check Point confirming that R82.20, standalone deployments, Log Servers and Multi-Domain servers are vulnerable, that the vulnerable path runs only through the Trusted Clients setting, and that a fix for out-of-support versions is available through Check Point support.
