"All Security Management Server deployments are vulnerable, regardless of configuration," Check Point warned — a blunt statement that underlines how a single software flaw can put the administrative heart of firewall estates at risk.
CVE-2026-91843: what the flaw is and what it enables
Check Point Software issued security updates to fix a critical vulnerability tracked as CVE-2026-91843. According to the vendor, the flaw is a stack-based buffer overflow in the login process for Security Management Server instances — the systems that manage Security Gateways (firewalls) and monitor network security events. The issue also affects Check Point's Log Server, the dedicated server that collects and stores firewall logs.
Successful exploitation can let an attacker without privileges gain remote code execution as root. Check Point described the attack as low complexity and not requiring user interaction, increasing the potential impact on exposed management infrastructure.
Scope of exposure: Security Management Server and Log Server
Check Point's advisory makes the scope explicit: management systems are vulnerable irrespective of configuration. The company warned that "The vulnerability is not dependent on any specific management configuration. The management is vulnerable even when VPN in not in use or configured." That language places all Security Management Server deployments and affected Log Server instances inside the risk envelope.
Because these systems centrally control firewalls and store administrative logs, a root-level compromise could provide attackers broad control and extended visibility into a victim's security environment.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleMitigations, LivePatch, and detection guidance
Check Point released updates and a LivePatch to address CVE-2026-91843. For customers that cannot immediately deploy the LivePatch, the vendor supplied temporary mitigation measures: harden vulnerable systems and restrict management access by limiting trusted IP addresses or subnets. Administrators are instructed to edit entries under Manage & Settings > Permissions & Administrators > Trusted Clients in the SmartConsole dashboard to reduce the attack surface.
To help detection, Check Point said security teams can look for a specific audit indicator: "Administrator failed to log in: Username too long" alerts in the Audit and Admin login logs. The vendor has not yet reported CVE-2026-91843 as actively exploited in the wild.
Related recent patches and the active-exploitation context
The advisory arrived in the wake of other critical Check Point fixes. Last week the company patched CVE-2026-85103, a heap overflow in the VPN certificate ASN.1 decoding flow that affects Check Point firewalls and management systems, and CVE-2026-85102, a critical flaw that allows unauthenticated attackers to bypass authentication and execute code remotely on vulnerable firewalls.
Check Point also flagged two authentication-bypass zero-days as actively exploited in recent months: CVE-2026-50751, abused by a Qilin ransomware affiliate since June, and CVE-2026-16232, which has been exploited since at least July to authenticate with administrator privileges to SmartConsole admin panels. The Dutch National Cyber Security Centre (NCSC-NL) has warned organizations to prioritize patching CVE-2026-85102 and CVE-2026-85103, saying it "expects exploitation attempts to occur soon."
What this means for security teams, enterprises, and regulators
- Security teams: Apply the published updates or the LivePatch as soon as feasible; for environments that cannot patch immediately, implement the vendor's temporary mitigations and hunt for the "Administrator failed to log in: Username too long" alert in Audit and Admin login logs.
- Affected enterprises and procurement leaders: Treat Security Management Server and Log Server instances as high priority for patching and access restriction. Use the SmartConsole route Manage & Settings > Permissions & Administrators > Trusted Clients to tighten which IPs/subnets can reach management interfaces.
- Regulators and national CERTs: The NCSC-NL advisory around related CVEs signals a heightened risk posture regionally; public warnings and prioritization guidance may be appropriate where Check Point infrastructure is widely used.
Check Point's bulletin ties a technical flaw to a larger pattern: although CVE-2026-91843 has not been reported as exploited yet, recent active abuse of other Check Point vulnerabilities and warnings by NCSC-NL sharpen the urgency. Organizations that run Check Point Security Management Server or Log Server should choose between immediate patching via the vendor update or LivePatch, or apply the documented hardening steps and trusted-client restrictions while monitoring for the specific login-failure alert.
