As reported by BleepingComputer, Check Point has disclosed CVE-2026-91843, a critical stack-based buffer overflow in the Security Management Server (SMS) login process that grants unauthenticated attackers root-level remote code execution. The flaw also affects the dedicated Log Server component. This is not an edge-case misconfiguration — it is a pre-authentication logic flaw in a core administrative interface, and the vendor confirms that all SMS deployments are vulnerable regardless of configuration.
Why This Matters
Security Management Server is the brain of a Check Point deployment — it manages firewall policies, distributes configurations to gateways, and centralizes log collection. Compromising SMS with root privileges is not just a server breach; it is a full infrastructure takeover. An attacker with root on SMS can push malicious firewall policies, silently exfiltrate traffic logs, pivot to managed gateways, and persist undetected across the entire perimeter estate.
The timing compounds the concern. This is Check Point's fourth critical disclosure in rapid succession, and two prior authentication bypass zero-days (CVE-2026-50751 and CVE-2026-16232) have already been exploited in the wild — one by a Qilin ransomware affiliate since June. The Dutch NCSC has separately urged prioritization of CVE-2026-85102 and CVE-2026-85103. The pattern is clear: Check Point management infrastructure is under active, systematic targeting.
Vulnerability Details
| CVE | Severity | Component | Impact | Exploited? |
|---|---|---|---|---|
| CVE-2026-91843 | Critical | SMS / Log Server login | Root RCE (pre-auth) | No (as of disclosure) |
| CVE-2026-85103 | Critical | VPN ASN.1 decoding | RCE (heap overflow) | No — patch urgently |
| CVE-2026-85102 | Critical | Firewall auth | Auth bypass + RCE | No — NCSC-NL expects exploitation |
| CVE-2026-50751 | High/Critical | SmartConsole auth | Auth bypass | Yes — Qilin ransomware since June |
| CVE-2026-16232 | High/Critical | SmartConsole auth | Admin auth bypass | Yes — since July |
Key takeaway: All four recent CVEs target administrative or VPN-facing surfaces. The attack surface is not the data plane — it is the control plane. Defenders who treat firewall management as hardened by default are making a dangerous assumption.
Who Is at Risk
Immediate Actions
- Deploy LivePatch now. Check Point has released a patch for CVE-2026-91843. This is the only complete remediation. Workarards reduce risk but do not eliminate the vulnerability.
- Restrict management access. Limit SMS/SmartConsole access to trusted internal IP ranges only. Navigate to Manage & Settings > Permissions & Administrators > Trusted Clients in SmartConsole and remove any broad or wildcard CIDR entries.
- Enable detection logging. Monitor Audit and Admin login logs for the specific alert: "Administrator failed to log in: Username too long." This is Check Point's documented indicator of CVE-2026-91843 exploitation attempts. Forward these logs to your SIEM with alerting rules.
- Patch the prior three CVEs if not already done. CVE-2026-85103 and CVE-2026-85102 were patched last week; CVE-2026-50751 and CVE-2026-16232 have active exploitation. Treat all four as prioritized.
- Network-segment management interfaces. SMS should never be reachable from the public internet. If it is, move it behind a jump host or VPN immediately — this applies to the Log Server as well.
Shield53 Recommendations
- Inventory and exposure audit: Enumerate every Check Point management interface across your environment. Map which are internet-facing, which have trusted-client restrictions, and which run unsupported versions.
- Assume breach posture for SMS: If you cannot patch within 24–48 hours, treat SMS as potentially compromised. Review recent policy pushes, admin account creation, and unexpected gateway configuration changes.
- Correlate with ransomware TTPs: Given Qilin's prior use of Check Point zero-days, ingest IOCs from Qilin campaigns and monitor for lateral movement from perimeter management into Active Directory or backup infrastructure.
- Implement permanent network hardening: Even after patching, enforce management-plane segmentation as a standing policy. The next disclosure is a matter of when, not if.
- Engage Check Point TAC for validation: Confirm patch status across all managed gateways and SMS HA clusters. LivePatch may not apply uniformly to clustered or multi-domain deployments.
The broader implication is uncomfortable: the vendors we trust to secure the perimeter are themselves perimeter. Check Point is not alone in facing this scrutiny — Palo Alto, Fortinet, and Ivanti have all weathered similar storms. The lesson for defenders is structural: treat security infrastructure management interfaces with the same zero-trust skepticism you apply to any other privileged system. Assume exposure, restrict aggressively, and patch as if the next ransomware affiliate is already reading the advisory.
