Check Point Patches Critical Root Access Vulnerability
Unauthenticated attackers could execute arbitrary code as root on security servers
1Critical authentication bypass
Check Point disclosed CVE-2026-91843, a critical vulnerability (CVSS 9.8) in Security Management and Log Servers. The flaw allows unauthenticated attackers to execute arbitrary code with root privileges through the login process. Attackers can trigger a stack overflow by sending login requests with extremely long usernames. The vulnerability affects servers with Trusted Clients setting enabled.
2Widespread impact
The vulnerability impacts multiple Check Point versions including R82.20, R82.10, R81.20, R81.10, and all EoS versions from R80 to R81. Censys identified 3,836 hosts globally running Security Management/Log Server roles, though not all may be vulnerable. These servers manage critical firewall rules and administrative access, making them high-value targets for attackers.
3Immediate patching required
Check Point released fixes through its LivePatch channel. Systems with automatic updates enabled are protected, while others must manually apply update sk1000155. The company strongly recommends immediate action due to the vulnerability's severity. No active exploitation has been observed yet, and no public proof-of-concept exists as of September 16.
4Technical mitigation steps
Beyond patching, organizations should restrict Trusted Clients access to known internal IPs and follow Check Point's hardening best practices. The vulnerability only affects systems with Trusted Clients setting enabled. Security teams should verify their update status and apply the fix immediately, especially for internet-facing management servers.
5Vulnerability discovery
Censys researchers identified the flaw in the login process before authentication occurs. The stack overflow vulnerability doesn't require any authentication, making it particularly dangerous. Check Point's advisory notes the attack path only works when SmartConsole's Trusted Clients feature is enabled for management server access.
6Version-specific risks
Affected versions include all R80 series (now End of Service) and multiple R81/R82 versions with specific Jumbo Hotfix levels. The vulnerability's impact varies by configuration, with Trusted Clients setting being the critical factor. Organizations should verify their exact version and hotfix level against Check Point's published advisory.
7Detection challenges
Censys notes that passive scanning can't determine vulnerable versions since build and hotfix levels aren't visible externally. The 3,836 observed hosts represent total Security Management/Log Server deployments, not confirmed vulnerable instances. Organizations must actively check their systems rather than relying on external scanning.
8Security implications
This vulnerability poses extreme risk as it allows complete system compromise without authentication. Successful exploitation could let attackers modify firewall rules, access logs, or deploy malware. The root-level access means attackers could establish persistent access even after patching if systems aren't thoroughly investigated post-exploitation.
Original article: Security Affairs — Check Point Patches Critical Root Access Vulnerability