Check Point critical flaw allows root RCE on management servers

Affected Systems

Check Point Security Management Server and Log Server (all deployments, regardless of configuration). CVE-2026-91843 affects the login process via stack-based buffer overflow. All versions prior to latest LivePatch are vulnerable.

Exploitation Status

Not currently exploited in the wild. Check Point has not flagged active exploitation. However, given recent pattern of Check Point zero-days (CVE-2026-50751, CVE-2026-16232) and Dutch NCSC warnings about related flaws, exploitation attempts are likely imminent.

Business Impact

Unauthenticated attackers can gain root-level remote code execution on Security Management Servers and Log Servers with low complexity and no user interaction. This grants full control over firewall management infrastructure, allowing threat actors to disable security controls, exfiltrate logs, pivot to managed Security Gateways, and establish persistent access to network security infrastructure. All deployments are vulnerable regardless of VPN or other configuration settings.

Urgency

🔴 Immediate

Recommended Actions

• Deploy Check Point LivePatch immediately to all Security Management Server and Log Server instances
• If patching is delayed, restrict management access to trusted IP addresses/subnets via SmartConsole: Manage & Settings > Permissions & Administrators > Trusted Clients
• Monitor Audit and Admin login logs for 'Administrator failed to log in: Username too long' alerts indicating CVE-2026-91843 exploitation attempts
• Review SmartConsole administrator access logs for unauthorized authentication events since vulnerability disclosure
• Prioritize patching CVE-2026-85102 and CVE-2026-85103 concurrently, as Dutch NCSC expects imminent exploitation of these related critical VPN flaws