The Login Screen on Your Security Manager Could Hand an Attacker Root
The management server decides how the firewalls behave. The log server holds the evidence used to understand what they saw. A critical Check Point flaw reaches both systems through the login process, before an attacker supplies valid credentials.
CVE-2026-91843 is a stack-based buffer overflow in Check Point Quantum Security Management. Check Point says a remote, unauthenticated attacker can execute arbitrary code as root. The CVSS 3.1 score is 9.8.
Which systems are affected
The affected roles include Security Management Server, Multi-Domain Security Management Server, Log Server and Multi-Domain Log Server. The Canadian Centre for Cyber Security lists the following supported release thresholds:
- R81.20 with Jumbo Hotfix Take 166 or earlier
- R82 with Jumbo Hotfix Take 126 or earlier
- R82.10 with Jumbo Hotfix Take 44 or earlier
- R82.20
End-of-support releases are also affected according to Check Point’s CVE record. CERT.LV lists patched target builds of R82.20 Take 29, R82.10 Take 28, R82 Take 28 and R81.20 Take 28. Administrators should reconcile those figures with Check Point’s live support article because hotfix guidance can change.
LivePatch may already have applied the fix
Check Point says customers with automatic LivePatch updates enabled may already be protected. That should be verified rather than assumed. The vendor directs administrators to confirm the patch in the LivePatch inventory. If the fix cannot be applied immediately, restrict the management interface to trusted clients and networks.
No exploitation in the wild was known at the time of the advisory, and no verified public proof of concept was identified in the reviewed sources. Exposure remains consequential because the vulnerable service is the control plane for network policy and audit data.
Patch the manager and review the evidence it controls
- Identify every management and log role. Include standalone and multi-domain deployments, secondary managers and disaster-recovery systems.
- Verify the actual hotfix or LivePatch. Check the running state on each server and retain the result.
- Restrict administrative exposure. Use trusted-client controls and network filtering, especially where patching is delayed.
- Review failed logins. Check for unusual oversized usernames and the vendor-described message indicating that a username was too long.
- Protect the logs. Export relevant evidence to a separate trusted system if compromise is suspected.
- Assess downstream trust. A compromised manager may have access to gateway policy, credentials and logging. Scope response to the privileges actually present.
Fixing CVE-2026-91843 closes the known login overflow. It does not prove that a previously exposed manager was untouched. The most important evidence may be held by the same platform whose integrity is in question.
Sources
- Check Point support article sk1000155, dated 16 September 2026. The full article may require a customer login.
- Canadian Centre for Cyber Security advisory AV26-933, published 17 September 2026. No publication time was provided.
- CERT.LV advisory and fixed-build guidance, published 18 September 2026. No publication time was provided.
- BleepingComputer, independent reporting, published 18 September 2026 at 05:34 as displayed.
