Securing Check Point Security Management and Log Servers Against CVE-2026-91843

Overview

CERT-In note CIVN-2026-0465 describes CVE-2026-91843, a critical remote code execution vulnerability in Check Point Security Management and Log Servers. The flaw is a stack overflow in the unauthenticated login process, and exploitation leads to arbitrary code execution with root privileges.

Mechanism

A remote attacker sends a specially crafted request to the login service. The input overflows a stack buffer, corrupting execution state and allowing the attacker to run code as root. The vulnerable routine executes before authentication, so credentials are not needed.

Impact

Because these servers manage policy and store logs, root access enables policy tampering, log manipulation and lateral movement to managed gateways.

Affected products and versions

Security Management Server, Multi-Domain Security Management Server, Log Server and Multi-Domain Log Server on R82.20; R82.10 Jumbo Hotfix Take 44 or prior; R82 Jumbo Hotfix Take 126 or prior; R81.20 Jumbo Hotfix Take 166 or prior; R81.10 Jumbo Hotfix Take 190 or prior (end of support); and R80, R80.10, R80.20, R80.30, R80.40 and R81 (end of support).

Remediation and mitigation

Install the vendor updates listed in advisory sk1000155 and the CERT-In note. Until patching is complete, restrict management and log interfaces to trusted networks, monitor login activity, and upgrade away from end-of-support releases.