Check Point's Fifth Critical Flaw Since July

A firewall management server is the console that decides which traffic gets blocked and who is allowed to change the rules. Check Point's Security Management Server does exactly that job for a large base of enterprise customers, which is why a flaw that lets someone reach it without logging in at all is worth close attention. According to reporting by The Hacker News, the company has shipped a fix for a 9.8 out of 10 severity bug that could allow code execution as root over the network, and it is the fifth critical unauthenticated management flaw the outlet has counted since July 22.

The vulnerability is tracked as CVE-2026-91843 and is described as a stack overflow in the login process, which handles requests before a user is authenticated. Internet scanning company Censys said the overflow is triggered by a login request carrying a very long username. Check Point rated the flaw 9.8 on the CVSS scale and released a fix through its LivePatch update channel.

The timing matters for defenders reading this. Check Point's notice on its CheckMates community was posted on September 16, 2026, and CISA recorded exploitation as "none" in its assessment attached to the CVE record on September 17. As of the catalog's September 16 release, which The Hacker News checked on September 17, the flaw was not in CISA's Known Exploited Vulnerabilities catalog.

How the overflow is triggered

The entry point is the login handler, the part of the server that processes incoming authentication requests. Because that code runs before a user is verified, an attacker does not need a credential, a session, or any prior access. Censys said a login request carrying an unusually long username is enough to trigger the stack overflow.

The vulnerable path is not open to the entire internet by default. Check Point told The Hacker News that it runs only through the Trusted Clients setting, the control that governs which hosts may connect to the management server through SmartConsole. That detail narrows the exposure, but it also means the security of the management plane depends heavily on how that setting has been configured by each customer.

Aviv Abramovich, vice president of product management for network security at Check Point, told The Hacker News that the vulnerable path is "only through trusted clients," and the company recommends customers verify the setting is not set to any IP address but to trusted hosts.

Check Point also stated there is no evidence the bug is being used. "At this time, there is no indication that this vulnerability has been exploited in the wild," the company's notice said. Censys said no public proof-of-concept exploit existed as of September 16, and Abramovich told The Hacker News the company had not received any reports of exploitation.

Versions that need patching now

Check Point's CVE record lists affected branches by Jumbo Hotfix Take, the numbered level of the update package that collects fixes for a release. A server on a listed branch at the listed Take or older is affected. The record lists:

• R82.10 with Jumbo Hotfix Take 44 or below
• R82 with Jumbo Hotfix Take 126 or below
• R81.20 with Jumbo Hotfix Take 166 or below
• R81.10 with Jumbo Hotfix Take 190 or below, plus R81, R80.40, R80.30, R80.20, R80.10 and R80, all of which are end of support

There is one gap in that list that customers should know about. The record does not list R82.20, but Abramovich said R82.20 is also vulnerable. Censys said in its advisory that every R82.20 build is affected and that no Jumbo Hotfix yet protects that branch.

Abramovich also said standalone deployments, which run management and gateway on one system, Log Servers, and Multi-Domain servers are vulnerable. An alert from NHS England Digital, citing sk1000155, says the hosted Smart-1 Cloud service is not affected because the fix is already in place there.

The CVE record marks R81.10 and the older branches as end-of-support. Check Point has a fix ready for those out-of-support versions, according to Abramovich, and customers who need it should log a ticket with Check Point support.

What administrators should do

Check Point's guidance is direct. Apply the LivePatch fix described in advisory sk1000155 to every Security Management Server and Log Server. The company urged customers to take immediate action because of the flaw's severity and potential impact, and said customers with automatic updates enabled are already protected.

Do not assume automatic updates have landed. Administrators should confirm the fix is installed rather than take it for granted. The cplp list command shows which LivePatches are installed and their status. That distinction matters because LivePatch delivery is not always instant: when Check Point pushed fixes for two VPN certificate flaws the previous week, several customers wrote in its community that the automatic package had not reached their systems on the day of the announcement. A Check Point community admin replied that it was presumably being rolled out in stages rather than to everyone at once, and customers found the download links in those advisories appeared only after signing in to the User Center.

Separately, and whether or not the fix is installed, administrators should check that management Trusted Clients access is limited to known, trusted hosts, is not set to any IP address, and is not exposed directly to the internet. The Trusted Clients setting lives in SmartConsole under Manage & Settings, Permissions & Administrators, Trusted Clients, according to Check Point's hardening guide. The same guide says direct internet access to management should be avoided and that a VPN is required.

The "automatic updates" setting referenced in the advisory is the one described in sk175504, per the hardening guide. It is the checkbox in SmartConsole, under Global Properties and Data Access Control, labeled "Automatically download and install Software Blade Contracts, security updates, and other important data (highly recommended)," followed by installation of the Access Control policy. LivePatch is the channel Check Point uses to push urgent security fixes to systems where that option is turned on.

How many servers are out there

Getting a precise tally of exposed systems is difficult because build and hotfix level are not visible in scan data. Censys said it observes 3,836 hosts worldwide that present the default identity Check Point gives its management and log servers, a method it chose for exactly that reason. The company was careful about what that number means. "This figure is total role presence, not a confirmed-vulnerable count," it said.

That caveat is worth keeping in mind when reading any headline built around the figure. A host presenting the default identity is not necessarily unpatched, and a host that has been patched may still present the same identity to a scanner. The actual number of vulnerable systems depends on which Jumbo Hotfix Take each deployment is running and whether the LivePatch has been applied.

The summer's run of management bugs

By The Hacker News' count of Check Point's CVE records, CVE-2026-91843 is the fifth critical flaw since July 22 that an attacker could reach on the Security Management Server without logging in. The pattern across those five is consistent: the entry point is authentication or the login path, and the target is the system that holds firewall policy and administrator access.

The first in that sequence, CVE-2026-16232, was a SmartConsole authentication bypass that was exploited in July. Check Point's Lotem Finkelstein wrote at the time that it affected "a handful of customers" in one configuration, "when Management is exposed directly to the internet without IP restrictions." The first mitigation step then was the one recommended now: limit Trusted Clients to trusted addresses. CISA added CVE-2026-16232 to its Known Exploited Vulnerabilities catalog the same day. A second management bypass disclosed that day, CVE-2026-62144, was not reported as exploited.

Two more followed. CVE-2026-18574, an authentication bypass that could allow command execution on the management server, was disclosed on August 3. CVE-2026-85103, a heap overflow in VPN certificate decoding that also reaches Quantum Security Management, was disclosed on September 9. Check Point said it found both internally and had no indication of exploitation.

Who found CVE-2026-91843 has not been disclosed, and Check Point did not address that question in its response to The Hacker News.

Why this matters for defenders

The recurring theme across all five flaws is configuration, not just patching. The vulnerability's reach is limited by the Trusted Clients setting, and the July exploitation of CVE-2026-16232 occurred in exactly the configuration Check Point warns against — management exposed directly to the internet without IP restrictions. That suggests the practical risk for any given organization depends as much on how its management plane is exposed as on which hotfix it is running. Teams that have kept direct internet access to management closed, restricted Trusted Clients to known hosts, and required VPN access are in a measurably different position from those that have not.

The patch question is more complicated than usual because of the R82.20 gap and the end-of-support branches. Censys said every R82.20 build is affected with no Jumbo Hotfix yet protecting that branch, and owners of R81.10 and older releases are working from versions Check Point has marked end of support. The company says a fix exists for those branches through support, but that path requires a support ticket, which takes time. Administrators on those versions should not wait for an automatic update that may not be coming to a branch with no listed Take.

For everyone else, the immediate actions are straightforward: verify the LivePatch status with cplp list rather than assuming automatic updates arrived, confirm Trusted Clients is limited to known hosts, and make sure management access is not reachable directly from the internet. None of that is novel advice. It is, however, the same advice that was issued in July and the same advice that Check Point is issuing again now — which may be the most telling detail in the whole advisory.

Reporting based on original coverage from The Hacker News.