GoKawiilCheck Point patches critical root RCE bug in Security Management Server, Log Server
Check Point has issued security updates for CVE-2026-91843, a stack-based buffer overflow in the login process of its Security Management Server and Log Server products. The flaw allows unauthenticated attackers to remotely execute code with root privileges in low-complexity attacks requiring no user interaction. Check Point says it isn't aware of active exploitation but has provided detection guidance and interim mitigations for customers who can't immediately apply the fix.
GoKawiil's interpretation of the reporting above, not reported fact.
Security Management Servers control firewall policies and monitor network events across an organization, so root-level compromise could let attackers silently reconfigure defenses or disable logging entirely. This marks the third critical remote-code-execution flaw Check Point has disclosed in its management and firewall products within roughly a week, underscoring mounting pressure on enterprises to patch core security infrastructure quickly.
- CVE-2026-91843 lets unauthenticated attackers gain root RCE on Check Point Security Management Server and Log Server.
- Check Point recommends restricting trusted IP access and monitoring for suspicious 'Username too long' login alerts as mitigation.
- This is the third critical RCE vulnerability Check Point has patched in its management/firewall products in about a week.
Source: bleepingcomputer.com, 2026-09-18
Published there as: “New Check Point flaw lets hackers execute code with root privileges”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.