Check Point Patches Fifth Critical Management-Plane Flaw in Three Months

Check Point released a fix for CVE-2026-91843 on September 16, 2026, a critical vulnerability rated CVSS 9.8 affecting Security Management Servers and Log Servers. It is the fifth authentication-bypass flaw in the Israeli company's management plane since July 2026, confirming a systemic pattern that exposes the administrative heart of enterprise firewalls to total compromise.

The Mechanism: Stack Overflow in Login, No Auth, Root

The flaw resides in the unauthenticated login process of Check Point management servers. As documented by Censys and reported by The Hacker News, the stack overflow is triggered by a login request carrying an excessively long username. The vulnerability allows remote arbitrary code execution with root privileges, the highest level in the underlying operating system.

The vulnerable path is not directly exposed to the internet. Aviv Abramovich, Check Point's VP of product management for network security, clarified that the attack path traverses exclusively the Trusted Clients setting, which controls which hosts may connect to the management server via SmartConsole. When this configuration is broadened or managed permissively, it expands the attack surface well beyond the boundaries intended by the vendor's zero-trust architecture.

The official CVE record confirms a CVSS 9.8 score with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Network is the access vector, attack complexity is low, no privileges or user interaction are required, and impact hits confidentiality, integrity, and availability with high severity across all three pillars.

"At this time, there is no indication that this vulnerability has been exploited in the wild" — Check Point, via The Hacker News

Affected Versions and Fix Coverage: The R82.20 Gap

The primary vendor advisory sk1000155 and the CVE.org record outline an extensive range of affected versions: R82.10 with Jumbo Hotfix Take 44 or earlier, R82 with Take 126 or earlier, R81.20 with Take 166 or earlier, R81.10 (End-of-Support) with Take 190 or earlier, and the R80.x-R81 series (EOS). Smart-1 Cloud, Check Point's managed service, is unaffected because the fix is already deployed in the cloud infrastructure.

A significant exception concerns R82.20: the branch is not listed in the CVE record, but Abramovich confirmed that every R82.20 build is vulnerable and no Jumbo Hotfix protects it at this time. Check Point has made the fix available via LivePatch for unsupported versions as well, with the recommendation to open a support ticket for manual activation.

LivePatch delivery, which requires no reboot or scheduled maintenance window, reduces protection latency but introduces a critical dependency on automatic-update configuration. Customers who have disabled LivePatch or operate in air-gapped environments remain exposed until manual intervention.

Five Flaws in Three Months: The Management-Plane Pattern

CVE-2026-91843 is the fifth critical vulnerability reachable without authentication on Check Point Security Management Servers since July 22, 2026. This frequency, concentrated in less than two calendar months, raises questions about the robustness of the code base that manages the control plane of the world's most widely deployed enterprise firewalls.

The management plane is the structural Achilles' heel of security infrastructures: when compromised, it turns defense tools into attack vectors. An actor who gains root RCE on a Security Management Server effectively obtains control over the policies of all managed firewalls, with the ability to alter rules, exfiltrate logs, or implant persistent access into the protected infrastructure.

The recurring pattern does not necessarily imply a regression in the secure development lifecycle, but it documents an attack surface that has been historically underestimated. Administrative interfaces, often designed for functionality and backward compatibility, accumulate technical debt that surfaces in concentrated fashion when the threat context intensifies.

Kaspersky and Tanium: Parallel Patches Without Granular Details

In the same time window, Kaspersky and Tanium published advisories for vulnerabilities in their own products. Tanium released five new advisories with high- and medium-severity defects, including two high-severity SQL injections in the Asset module and the Threat Response module. The extracted source texts do not contain specific CVE identifiers or CVSS scores for these vulnerabilities.

Kaspersky published an advisory on September 17, 2026 for Kaspersky Security 10 for Linux Mail Server, addressing a Redis vulnerability discovered in 2023 that can cause malfunction or code execution. Here too, the extracted text does not report a specific CVE associated with the patch.

The lack of granular technical details for Tanium and Kaspersky prevents comparative risk assessment and limits the ability of security teams managing multi-vendor portfolios to prioritize patches. This opacity, while not unusual in initial disclosure cycles, creates operational friction for enterprise organizations.

What to Do Now

• Verify LivePatch activation on Check Point Security Management Servers and Log Servers, with particular attention to R82.20 versions and EOS installations that require a support ticket for the fix.
• Review the Trusted Clients configuration to restrict the perimeter of hosts authorized to connect via SmartConsole, removing obsolete or excessively broad authorizations.
• Monitor official Tanium and Kaspersky vendor sources for the potential publication of CVEs and CVSS scores that would enable prioritization of patches in change-management cycles.
• Assess network segmentation of the Check Point management plane, isolating management servers from segments with general user access and limiting administrative sessions to controlled jump servers.

The Management Plane as a Strategic Attack Surface

The concentration of five critical authentication-bypass vulnerabilities in a single architectural component is not a statistical accident: it reflects the centrality of the management plane as a high-value target for sophisticated threat actors. Compromise of this layer does not merely violate an endpoint; it subverts the entire perimeter defense logic.

Check Point has demonstrated reactivity in fix distribution, but reactivity does not replace reduction of the original attack surface. The question CISOs should ask is not how quickly a vendor patches, but how much of their control plane is exposed to single points of failure that grant root without authentication.

The enterprise security ecosystem finds itself in a reverse supply-chain condition: products purchased to reduce risk become, through vulnerabilities like CVE-2026-91843, the privileged channels for its realization. The measure of an organization's cyber maturity increasingly lies in the ability to protect its own protectors.

Sources

• https://www.securityweek.com/check-point-kaspersky-tanium-patch-product-vulnerabilities/
• https://thehackernews.com/2026/09/critical-check-point-management-server.html
• https://support.checkpoint.com/security-advisories
• https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/
• https://nvd.nist.gov/vuln/detail/CVE-2026-50751
• https://www.cve.org/CVERecord?id=CVE-2026-91843
• https://nvd.nist.gov/vuln
• https://support.checkpoint.com/results/sk/sk1000155
• https://security.tanium.com/
• https://support.kaspersky.com/vulnerability/list-of-advisories/12430#170926

Information verified against cited sources and current as of publication.

Sources