Affected Systems
Check Point Security Management Server and Log Server: R82.20 (all builds), R82.10 (Jumbo Hotfix Take ≤44), R82 (Take ≤126), R81.20 (Take ≤166), R81.10 (Take ≤190), and R81, R80.40, R80.30, R80.20, R80.10, R80 (end-of-support). Standalone deployments, Log Servers, and Multi-Domain servers also affected. Smart-1 Cloud service not affected.
Exploitation Status
No evidence of active exploitation as of September 17, 2026. CISA recorded exploitation status as "none." Not in CISA KEV catalog. No public proof-of-concept available. Check Point reports no exploitation incidents.
Business Impact
CVE-2026-91843 (CVSS 9.8) is a stack overflow in the login process that allows unauthenticated remote code execution as root on management and log servers. Vulnerable path requires access through Trusted Clients setting. Successful exploitation grants full administrative control over firewall policy and management infrastructure. Censys identifies 3,836 potentially exposed hosts worldwide. This is the fifth critical unauthenticated management flaw since July 2026, following CVE-2026-16232 which was actively exploited.
Urgency
🔴 Immediate
Recommended Actions
- Apply LivePatch fix per sk1000155 to all Security Management Servers and Log Servers immediately, including standalone and Multi-Domain deployments
- Verify fix installation using 'cplp list' command even if automatic updates are enabled—rollout may be staged
- Audit Trusted Clients configuration in SmartConsole (Manage & Settings > Permissions & Administrators > Trusted Clients) to ensure access is restricted to specific known hosts, not 'any IP address'
- Confirm management interfaces are not directly exposed to the internet and require VPN access per Check Point hardening guidance
- For end-of-support versions (R81.10 and older), open support ticket with Check Point to obtain fix for out-of-support branches