# Check Point Patches Critical Root Access Vulnerability Unauthenticated attackers could execute arbitrary code as root on security servers - **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb) - **Published:** 2026-09-18 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/2e9db9c8-6c3c-4801-b2b2-9e5b2265c85c ## Critical authentication bypass Check Point disclosed CVE-2026-91843, a critical vulnerability (CVSS 9.8) in Security Management and Log Servers. The flaw allows unauthenticated attackers to execute arbitrary code with root privileges through the login process. Attackers can trigger a stack overflow by sending login requests with extremely long usernames. The vulnerability affects servers with Trusted Clients setting enabled. ## Widespread impact The vulnerability impacts multiple Check Point versions including R82.20, R82.10, R81.20, R81.10, and all EoS versions from R80 to R81. Censys identified 3,836 hosts globally running Security Management/Log Server roles, though not all may be vulnerable. These servers manage critical firewall rules and administrative access, making them high-value targets for attackers. ## Immediate patching required Check Point released fixes through its LivePatch channel. Systems with automatic updates enabled are protected, while others must manually apply update sk1000155. The company strongly recommends immediate action due to the vulnerability's severity. No active exploitation has been observed yet, and no public proof-of-concept exists as of September 16. ## Technical mitigation steps Beyond patching, organizations should restrict Trusted Clients access to known internal IPs and follow Check Point's hardening best practices. The vulnerability only affects systems with Trusted Clients setting enabled. Security teams should verify their update status and apply the fix immediately, especially for internet-facing management servers. ## Vulnerability discovery Censys researchers identified the flaw in the login process before authentication occurs. The stack overflow vulnerability doesn't require any authentication, making it particularly dangerous. Check Point's advisory notes the attack path only works when SmartConsole's Trusted Clients feature is enabled for management server access. ## Version-specific risks Affected versions include all R80 series (now End of Service) and multiple R81/R82 versions with specific Jumbo Hotfix levels. The vulnerability's impact varies by configuration, with Trusted Clients setting being the critical factor. Organizations should verify their exact version and hotfix level against Check Point's published advisory. ## Detection challenges Censys notes that passive scanning can't determine vulnerable versions since build and hotfix levels aren't visible externally. The 3,836 observed hosts represent total Security Management/Log Server deployments, not confirmed vulnerable instances. Organizations must actively check their systems rather than relying on external scanning. ## Security implications This vulnerability poses extreme risk as it allows complete system compromise without authentication. Successful exploitation could let attackers modify firewall rules, access logs, or deploy malware. The root-level access means attackers could establish persistent access even after patching if systems aren't thoroughly investigated post-exploitation. ## Sources covering this story - https://securityaffairs.com/199279/security/check-point-fixes-critical-cve-2026-91843-allowing-root-code-execution.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._