CVE-2026-91843: Critical Pre-Auth Root RCE in Check Point Security Management — What the Advisories Actually Say

Check Point has patched a 9.8-rated stack overflow in the unauthenticated login process of its Security Management and Log Servers. No exploitation has been confirmed yet, but the pattern behind it is starting to look familiar.

Check Point's Security Management Server is the box that pushes firewall policy and controls who gets administrative access across an organization's Check Point estate. It's the kind of system you really don't want reachable by an attacker who hasn't logged in yet — which is exactly the scenario Check Point disclosed on September 16, 2026, in a notice on its CheckMates community forum.[1]

What the Vulnerability Is

The flaw is tracked as CVE-2026-91843, a stack-based buffer overflow[2] in the login process — the code path that handles a connection attempt before the server has authenticated anyone. Censys, which published a rapid-response advisory the same day, said the overflow is triggered by a login request carrying an excessively long username.[2] Send a crafted value there, and instead of rejecting it cleanly, the server can be made to execute attacker-controlled code with root privileges.[2]

That's about as bad as pre-auth bugs get on a network appliance. There's no password to steal or session to hijack first — the code runs before authentication even starts. NVD classifies it under CWE-121, stack-based buffer overflow, and Check Point assigned it a CVSS v3.1 score of 9.8, critical.[2] NHS England Digital's advisory independently lists the same score.[3]

Worth being precise here, since it's easy to blur the terms: a stack overflow that can be steered into root code execution is not automatically the same thing as a working exploit sitting on GitHub. Nobody has demonstrated a public working trigger for this one yet — Censys said no proof-of-concept was available as of the date of its advisory.[2]

Affected Products and Versions

Three independently published sources — Check Point's own advisory (sk1000155, referenced by both), NHS England Digital, and Censys — line up on which branches are exposed:[2][3]

• R82.20 — every build, since no Jumbo Hotfix currently protects that branch[2]
• R82.10 — Jumbo Hotfix Take 44 or below
• R82 — Take 126 or below
• R81.20 — Take 166 or below
• R81.10 — Take 190 or below (end of support)
• R81, R80.40, R80.30, R80.20, R80.10, R80 — all versions, all end of support[2][3]

The affected product list also isn't limited to the standalone Security Management Server. NHS England Digital names Multi-Domain Security Management Server, Log Server, and Multi-Domain Log Server as affected too.[3] Check Point's hosted Smart-1 Cloud offering is explicitly excluded — the fix was already deployed there before public disclosure.[2][3]

One detail that's easy to miss: Check Point's own CVE record doesn't list R82.20 by name, but the vendor advisory it points to (sk1000155) does, and both NHS England Digital and Censys confirm R82.20 as affected — with Censys specifically noting it's the one branch with no protective Jumbo Hotfix available yet.[2][3] If you're running R82.20, don't assume the absence of a line item in the CVE metadata means you're clear.

Exploitation Status: What's Actually Confirmed

Here's the part that matters most for triage. Check Point told customers in its community notice that it has "no indication that this vulnerability has been exploited in the wild."[1] Censys separately confirmed CVE-2026-91843 isn't listed in CISA's Known Exploited Vulnerabilities catalog or VulnCheck's KEV.[2] The Hacker News checked the KEV catalog's September 16 release itself and found the same thing.[1]

So: critical severity, but no confirmed exploitation yet. Those are two different facts and they shouldn't get flattened into one headline. That said, Censys' own read on the situation is worth repeating rather than softening: "a pre-auth RCE against network security management infrastructure tends to get weaponized fast once someone publishes a working trigger."[2] Given that a stack overflow triggered by an oversized username is a fairly well-understood bug class, a working exploit isn't a huge technical leap for someone motivated to build one.

Exposure on the Internet

Censys scanned for the default identity Check Point assigns to management and log servers, since build and hotfix level aren't visible in passive scan data, and found 3,836 hosts globally presenting that identity.[2] Censys was careful to flag exactly what that number does and doesn't mean: it's total product-and-role presence, not a count of confirmed-vulnerable systems, because the scan can't see patch level.[2] Some of those nearly 4,000 hosts are almost certainly already patched or protected by LivePatch; the figure is a starting point for scale, not a victim count.

Patch and Mitigation

Check Point distributes the fix through its LivePatch channel rather than a standalone build, and customers with automatic updates enabled should already be protected.[1][2] Everyone else needs to apply the update described in advisory sk1000155 manually.[1]

What Administrators Should Do

1. Apply the LivePatch fix described in sk1000155 to every Security Management Server and Log Server, including Multi-Domain variants.[1]
2. Don't assume automatic updates already worked. Confirm with cplp list to see which LivePatches are actually installed rather than taking the setting's presence on faith.[1] The Hacker News noted that when Check Point pushed fixes for two VPN certificate flaws the week before, several customers reported the automatic package hadn't reached their systems on announcement day — rollout was apparently staged rather than immediate.[1]
3. Restrict Trusted Clients to known internal IP addresses if you can't patch right away, and don't expose management access directly to the internet.[1] Check Point has not said whether this specifically blocks exploitation of CVE-2026-91843, so treat it as a compensating control, not a confirmed fix.[1]

For branches marked end of support — R81.10, R81, and the R80.x line — there's no patch coming. Censys was blunt about it: upgrading to a supported release is the only way to close the hole.[2]

The Bigger Pattern: Fifth Pre-Auth Management Flaw Since July

What makes this one worth paying attention to beyond its own CVSS score is the company it keeps. By The Hacker News' count, CVE-2026-91843 is the fifth critical, unauthenticated-reachable flaw disclosed in Check Point's Security Management Server since July 22, 2026.[1]

The first of that run, CVE-2026-16232, a SmartConsole authentication bypass, actually was exploited — Check Point's Lotem Finkelstein said it affected "a handful of customers" in configurations where management was exposed directly to the internet without IP restrictions, and CISA added it to KEV the same day it was disclosed.[1] A second bypass disclosed the same day, CVE-2026-62144, wasn't reported as exploited. Two more followed: CVE-2026-18574 on August 3, an authentication bypass enabling command execution, and CVE-2026-85103 on September 9, a heap overflow in VPN certificate decoding that also reaches Quantum Security Management. Check Point said it found both of those internally with no indication of exploitation.[1]

Four disclosures, one confirmed exploitation, and now a fifth bug with the same profile — unauthenticated, reachable, management-plane. That's not proof this one will follow CVE-2026-16232's path into active abuse. But it is a reasonable argument for treating "restrict Trusted Clients to known IPs" as a standing baseline for Check Point management servers rather than a one-off response to a single advisory.

Check Point hasn't disclosed who found CVE-2026-91843. The Hacker News reported it had asked Check Point three open questions that remain unanswered as of publication: whether R82.20 is affected (the versions listed above answer this from the corroborating sources, even though the CVE record itself omits it), whether restricting Trusted Clients actually prevents exploitation, and whether standalone deployments running management and gateway on the same system are affected.[1]

Security Takeaway

Nothing here says this bug is being exploited today. Everything here says it's the kind of bug that gets exploited eventually, on infrastructure that a lot of organizations still leave reachable from places it shouldn't be. If you run Check Point Security Management or Log Servers, the actual priority order is: confirm your patch level rather than trust the automatic-update setting, apply sk1000155 if you haven't, and lock down Trusted Clients regardless of patch status. None of that requires waiting for a KEV listing to act.

Sources & References

• [1] The Hacker News — Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root — Sep 17, 2026
• [2] Censys — Sept. 16 Advisory: Check Point Quantum Security Management and Log Server Unauthenticated Login Stack Overflow [CVE-2026-91843] — Sep 16, 2026
• [3] NHS England Digital — Check Point Releases Security Advisory for Critical Vulnerability in Security Management and Log Servers (CC-4854) — Sep 17, 2026
• [4] Check Point Software Technologies — sk1000155 vendor advisory — referenced via [2] and [3]; not directly accessible to automated retrieval at time of writing

Disclaimer: Version and Jumbo Hotfix Take numbers change as Check Point ships further updates. Confirm current patch status against sk1000155 directly before treating this article's version table as current.