A stack overflow during the unauthenticated login process may

CVE-2026-91843 is a pre-authentication stack-based buffer overflow (CWE-121) in the login handler of Check Point's Security Management Server, Multi-Domain Security Management Server, Log Server, and Multi-Domain Log Server. An attacker sends an oversized username string to the management interface (typically TCP 18264/19009); the fwm process copies it onto the stack without bounds checking, overwriting the return address. No credentials, no user interaction, no special configuration — just a single crafted packet. Affected versions span R80 through R82.20 (with specific Jumbo Hotfix take thresholds), covering essentially every supported and recently-EOL release. Smart-1 Cloud is not affected.

The vendor's CVSS 9.8 CRITICAL rating is honest and, if anything, undersells the real-world consequence. This isn't a firewall data-plane bug that crashes a gateway — it's root-level code execution on the management plane, the box that holds every firewall policy, every admin credential, every VPN PSK, every certificate, and every audit log in your Check Point estate. Compromising the SMS is functionally equivalent to owning every gateway it manages. The vendor severity is accurate.

Why this verdict

• Pre-auth, zero-interaction, network-reachable: CVSS:3.1/AV:N/AC:L/PR:N/UI:N — the attack surface is as broad as it gets. No credentials, no phishing, no user click. Baseline vendor score of 9.8 is warranted for the technical capability.
• Root-level impact with no escalation needed: The fwm process runs as root on Gaia OS. A successful overflow is instant root. No second-stage privilege escalation step required.
• Role multiplier — SMS is a fleet-control node by definition: The Security Management Server is not a workstation or a line-of-business app. 100% of SMS installations occupy the high-value role because that IS the role. Compromising it yields every firewall policy, admin credential, ICA cert, SIC trust key, and VPN PSK — and lets the attacker push modified policies to every managed gateway. Blast radius: fleet-scale. The verdict floor is CRITICAL per the role-multiplier rule.
• Prior targeting of this exact attack surface: CVE-2026-16232 (SmartConsole auth bypass, Rapid7 PoC published) was KEV-listed in July 2026 with a 3-day CISA remediation deadline, proving adversaries are actively hunting Check Point management plane bugs. This makes exploitation of CVE-2026-91843 a matter of when, not if.
• Friction audit — delays but does not reduce impact: Network segmentation (management VLAN) reduces reachability for internet-origin attackers, but community evidence and Shodan data confirm a significant fraction of deployments expose management ports. Even in segmented environments, any attacker with internal network access (post-phish, post-VPN, lateral movement) reaches the SMS. No public PoC exists yet (2026-09-17), but CWE-121 stack overflow via oversized input is one of the most well-understood exploit primitives — development time is days, not months.

Why not higher?

9.8 is already the CVSS ceiling for Scope:Unchanged. The CVSS spec does not go higher. If Scope:Changed were applicable (arguable given the gateway fleet impact), the score would exceed 10.0, which is capped. There is no room to upgrade.

Why not lower?

Every friction point (network segmentation, no public PoC yet, ASLR/stack canaries) is a delay, not a barrier. The SMS is a high-value-role component by definition — 100% of SMS installations occupy the high-value role because that IS the role. The blast radius (fleet compromise via policy push) means the verdict floor is CRITICAL per the role-multiplier rule. Downgrading past the floor would require evidence that <1% of the installed base occupies the high-value role, which is impossible for a product whose sole purpose is centralized firewall management. The July 2026 KEV listing of CVE-2026-16232 on the same attack surface confirms active adversary interest.

1. Restrict SmartConsole Trusted Clients to approved IPs immediately — In SmartConsole → Manage & Settings → Permissions & Administrators → Trusted Clients, lock down to specific admin workstation IPs or a jump-host subnet. This removes network reachability for untrusted sources and is the single highest-impact compensating control. Deploy within the noisgate CRITICAL mitigation SLA of 3 days.
2. Deploy Check Point LivePatch on all SMS and Log Servers — LivePatch patches the fwm process in memory without a reboot. Run cplp list in Expert mode — the patch should show 'armed' status with CVE-2026-91843 in the comment field. Deploy within 3 days.
3. Block management ports at the perimeter — Ensure TCP 18264, 18190, 19009 are not reachable from the internet or untrusted network segments via perimeter firewall rules upstream of the Check Point estate. Deploy within 3 days.
4. Monitor for exploitation attempts — Search SmartConsole audit logs for 'Administrator failed to log in: Username too long.' Set up alerting on this string. Any hit is a confirmed exploitation attempt — trigger incident response immediately.
5. Migrate end-of-support releases — R80.x, R81, and R81.10 are EOS and will not receive patches. Plan migration to R81.20+ or R82.x within the noisgate CRITICAL remediation SLA of 90 days.

Run on each Check Point Security Management Server or Log Server via SSH in Expert mode (expert command). No additional privileges beyond Expert mode are needed. Example: chmod +x check_cve_2026_91843.sh && ./check_cve_2026_91843.sh

#!/bin/bash
# check_cve_2026_91843.sh - Verify CVE-2026-91843 patch status
# Run on Check Point SMS/Log Server in Expert mode
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

echo "=== CVE-2026-91843 Patch Verification ==="
echo "Target: $(hostname) | Date: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
echo ""

# Check if this is a Check Point system
if [ ! -f /etc/cp-release ]; then
    echo "UNKNOWN - Not a Check Point system"
    exit 2
fi

echo "System: $(cat /etc/cp-release)"
echo ""

# Check LivePatch status
if command -v cplp &>/dev/null; then
    LIVEPATCH_OUTPUT=$(cplp list 2>&1 || true)
    echo "LivePatch status:"
    echo "$LIVEPATCH_OUTPUT"
    echo ""
    if echo "$LIVEPATCH_OUTPUT" | grep -qi "CVE-2026-91843" && echo "$LIVEPATCH_OUTPUT" | grep -qi "armed"; then
        echo "PATCHED - LivePatch for CVE-2026-91843 is armed"
        exit 0
    fi
else
    echo "WARNING: cplp command not found - LivePatch may not be installed"
fi

# Check installed hotfix version
VERSION=$(cat /etc/cp-release 2>/dev/null | grep -oP 'R\d+\.?\d*' | head -1 || echo "")
TAKE=$(cpinfo -y fw1 2>/dev/null | grep -i "take" | grep -oP '\d+' | tail -1 || echo "0")

echo "Detected version: $VERSION, Take: $TAKE"
echo ""

case "$VERSION" in
    R82.20)
        if [ "$TAKE" -ge 29 ]; then
            echo "PATCHED - $VERSION Take $TAKE >= Take 29"
            exit 0
        else
            echo "VULNERABLE - $VERSION Take $TAKE < Take 29"
            exit 1
        fi
        ;;
    R82.10)
        if [ "$TAKE" -ge 45 ]; then
            echo "PATCHED - $VERSION Take $TAKE >= Take 45"
            exit 0
        else
            echo "VULNERABLE - $VERSION Take $TAKE <= Take 44"
            exit 1
        fi
        ;;
    R82)
        if [ "$TAKE" -ge 127 ]; then
            echo "PATCHED - $VERSION Take $TAKE >= Take 127"
            exit 0
        else
            echo "VULNERABLE - $VERSION Take $TAKE <= Take 126"
            exit 1
        fi
        ;;
    R81.20)
        if [ "$TAKE" -ge 167 ]; then
            echo "PATCHED - $VERSION Take $TAKE >= Take 167"
            exit 0
        else
            echo "VULNERABLE - $VERSION Take $TAKE <= Take 166"
            exit 1
        fi
        ;;
    R81.10|R81|R80.40|R80.30|R80.20|R80.10|R80)
        echo "VULNERABLE - $VERSION is end-of-support. No patch available. Migrate immediately."
        exit 1
        ;;
    *)
        echo "UNKNOWN - Unrecognized version: $VERSION"
        exit 2
        ;;
esac

Sources

1. Check Point Advisory SK1000155
2. CyberSecurity News — Check Point Root Access Flaw
3. SecurityOnline — Check Point Login Flaw CVE-2026-91843
4. Strix AI — CVE-2026-91843 Analysis
5. OffSeq Threat Radar — CVE-2026-91843
6. Cryptika — Check Point Root Access Vulnerability
7. CheckMates — Management Server Internet Exposure
8. BleepingComputer — CVE-2026-16232 SmartConsole Zero-Day