**Check Point** has issued an urgent advisory regarding a critical vulnerability, **CVE-2026-91843**, affecting its Security Management and Log Servers. This flaw, rated 9.8 on the CVSS scale, enables an unauthenticated attacker to execute arbitrary code as root on vulnerable servers via the network. ### The Vulnerability Explained The vulnerability is a stack overflow within the login process, triggered by a malformed login request containing an excessively long username, as identified by internet scanning company **Censys**. Crucially, the flaw resides in the pre-authentication phase, meaning an attacker does not require any credentials to exploit it. **Check Point** clarified that the vulnerable path is specifically through the 'Trusted Clients' setting, which dictates which hosts can connect to the management server via **SmartConsole**. While there is currently no indication of in-the-wild exploitation, the severity necessitates immediate action. ### Affected Versions and Patches **Check Point** has released a fix via its LivePatch update channel. Customers with automatic updates enabled are likely already protected, but verification is strongly recommended. The company's advisory, **sk1000155**, provides detailed patching instructions. The following **Check Point** branches and Jumbo Hotfix Takes are affected: * R82.10 with Jumbo Hotfix Take 44 or below * R82 with Jumbo Hotfix Take 126 or below * R81.20 with Jumbo Hotfix Take 166 or below * R81.10 with Jumbo Hotfix Take 190 or below * R81, R80.40, R80.30, R80.20, R80.10, and R80 (all end-of-support) **Aviv Abramovich**, VP of Product Management for Network Security at **Check Point**, confirmed that R82.20 is also vulnerable, with no Jumbo Hotfix yet available for that branch. Standalone deployments, Log Servers, and Multi-Domain servers are also impacted. For end-of-support versions, a fix is available by contacting **Check Point** support.  ### Recommended Actions for Administrators 1. **Apply the LivePatch fix**: Immediately implement the fix described in **sk1000155** on all Security Management Servers and Log Servers. 2. **Verify automatic updates**: Even with automatic updates enabled, confirm the patch's installation using the `cplp list` command. 3. **Restrict Trusted Clients**: Ensure management access via the 'Trusted Clients' setting is strictly limited to known, trusted hosts. Do *not* set it to 'any IP address' and avoid exposing management access directly to the internet. It's important to note that while automatic updates are designed to deliver these fixes, their rollout may be staged, as observed with previous **Check Point** security updates. ### A Pattern of Critical Flaws This is the fifth critical unauthenticated flaw in **Check Point**'s Security Management Server since July. Previous vulnerabilities include **CVE-2026-16232** (an exploited **SmartConsole** authentication bypass), **CVE-2026-62144**, **CVE-2026-18574** (an authentication bypass leading to command execution), and **CVE-2026-85103** (a heap overflow in VPN certificate decoding). The recurring nature of these high-severity flaws underscores the critical need for diligent patching and adherence to hardening guidelines.