Check Point patches a 9.8 root flaw in its login process

Check Point has patched a critical stack overflow in the login process of its Security Management and Log Servers, the systems that hold firewall policy and control administrator access. The flaw is tracked as CVE-2026-91843 and carries a CVSS 3.1 base score of 9.8: network attack vector, low complexity, no privileges and no user interaction required. Because the bug sits in the code that handles login requests before anybody is authenticated, an attacker does not need a username or a password to reach it.

What the record actually says

Check Point's own CVE record, published on 16 September, describes “a stack overflow during the unauthenticated login process” that “may allow an attacker to run arbitrary code remotely with root privileges”. The scanning firm Censys told The Hacker News that the overflow is triggered by a login request carrying a very long username, and that no public proof-of-concept had appeared as of 1 September. Check Point said the vulnerable path runs only through the Trusted Clients setting, which controls which hosts may connect to the management server through SmartConsole.

The fix has already shipped

A remedy is available through Check Point's LivePatch update channel, and the company says customers with automatic updates enabled are already protected. Everyone else should apply the LivePatch set out in advisory sk1000155. Check Point has said there is “no indication that this vulnerability has been exploited in the wild”, and CISA recorded exploitation as “none” against the CVE record on 17 September. The flaw was not in CISA's Known Exploited Vulnerabilities catalogue at its 16 September release.

Why a management server is the worst place for a bug like this

A firewall is very good at keeping strangers out of your network. The server that writes its rules sits behind the firewall, and that is the machine with the 9.8. Root access there means an attacker can rewrite policy, push new rules to every gateway, mint extra administrator accounts and turn logging off, with the whole lot signed off as legitimate configuration. The Trusted Clients restriction narrows the exposure a long way, but it is also the setting administrators widen first when a colleague cannot log in from a new VPN pool, which is exactly how a theoretical bug becomes an urgent one. If a management console is reachable from the internet, this is the week to move it, trim the Trusted Clients list to the smallest sensible set of addresses, and read the logs for login attempts carrying absurdly long usernames.

Our opinion

There is a particular kind of comfort in a vendor saying a bug is only reachable through one configurable setting. It is true, and it is also how most of these end up mattering, because the setting that was meant to be tight gets widened over a few years by people who had tickets to close. Check Point deserves credit for shipping the fix through LivePatch rather than parking it behind a maintenance window, and for putting its own name on the CVE record instead of waiting for a researcher to do it. The awkward question is what the login path is doing that lets an unauthenticated stranger overflow a stack at all. Patch this week, not next quarter.