Security 1 publisher2 min readPublished September 17, 2026 at 9:49 PM PDT

Unauthenticated attackers can run code as root on Check Point's Security Management Server

Check Point rates CVE-2026-91843 at 9.8 and shipped the fix through LivePatch sk1000155 on September 16. Its own CVE record leaves out R82.20, a branch the company's network security product VP says is vulnerable.

The Watch · Security desk

Illustration accompanying Unauthenticated attackers can run code as root on Check Point's Security Management Server

What happened

Check Point's Security Management and Log Servers carry a stack overflow in the login process, which handles requests before authentication, letting an unauthenticated attacker on the network run code as root.
Check Point posted the fix on its CheckMates community on September 16, 2026, said customers with automatic updates enabled are already protected, and told everyone else to apply LivePatch sk1000155.
Abramovich said Log Servers, Multi-Domain servers and standalone deployments that run management and gateway on one system are vulnerable as well.
CISA recorded exploitation as none in the assessment attached to the CVE record on September 17.

Compiled by The WatchSomething wrong?How this is made

Why it matters

exposure Where the Trusted Clients list accepts any IP address and management access is reachable from the internet, the pre-authentication login handler sits in front of any host that can route to it.
constraint Censys says no Jumbo Hotfix protects R82.20 yet, so LivePatch is the route for that branch, and the end-of-support branches need a Check Point support ticket to get a fix at all.
contradiction An estate audited against the CVE record's branch list will pass R82.20 servers as unaffected, and Check Point's network security product VP and Censys both say those servers are vulnerable.
decision Relying on the automatic channel is now a choice with recent evidence against it: on last week's VPN certificate fixes, customers reported the package had not arrived on announcement day.

Check Point told The Hacker News that the vulnerable path runs only through Trusted Clients, the setting that controls which hosts may connect to the management server through SmartConsole ^[5]. Censys says the overflow is triggered by a login request carrying a very long username ^[4]. The company's own CVSS rating is 9.8 out of 10 ^[2]. Its guidance, patched or not, is to confirm Trusted Clients is limited to known trusted hosts and not set to any IP address, and to keep management access off the internet ^[6].

Nothing in the record points to exploitation. "At this time, there is no indication that this vulnerability has been exploited in the wild," the CheckMates notice said ^[8]. The flaw was not in CISA's Known Exploited Vulnerabilities catalog as of that catalog's September 16 release ^[10]. Censys said no public proof-of-concept exploit existed as of September 16 ^[11]. Aviv Abramovich, Check Point's vice president of product management for network security, told The Hacker News that the company had not received any reports of exploitation ^[12]. The dated statements all fall on September 16 and 17 ^[3].

The affected list in the CVE record is keyed to Jumbo Hotfix Take, the numbered level of the update package that collects fixes for a release: R82.10 at Take 44 or below, R82 at 126 or below, R81.20 at 166 or below, R81.10 at 190 or below, plus the end-of-support branches R81, R80.40, R80.30, R80.20, R80.10 and R80 ^[13]. R82.20 is not on that list, and Abramovich said R82.20 is vulnerable as well ^[14]. NHS England Digital, citing sk1000155, says the hosted Smart-1 Cloud service is not affected because the fix is already in place there ^[18].

Automatic updates has a specific meaning here, set out in sk175504: a SmartConsole checkbox under Global Properties and Data Access Control, labeled "Automatically download and install Software Blade Contracts, security updates, and other important data (highly recommended)," followed by installation of the Access Control policy ^[19]. LivePatch is the channel Check Point uses to push urgent security fixes to systems where that option is turned on ^[19]. Check Point says to confirm the fix has been installed instead of assuming it, and the cplp list command shows which LivePatches are installed and their status ^[20].

What to watch

CVE-2026-91843 appearing in CISA's KEV catalog, or a public proof-of-concept landing, either of which shortens the patch window.
A Jumbo Hotfix Take that covers R82.20, and a CVE record updated to list that branch.
Whether this LivePatch reaches automatic-update customers on the day of the announcement.

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
CVE-2026-91843 is a stack overflow in the login process of Check Point's Security Management and Log Servers; the login process handles requests before a user is authenticated, and the flaw could allow an attacker without login credentials to run code as root on those servers over the network.
ReportedSupported2 sources— sign in to open View cited source
[2]
Check Point rated CVE-2026-91843 9.8 out of 10 on the CVSS scale.
ReportedSupported2 sources— sign in to open View cited source
[4]
Internet scanning company Censys said the overflow is triggered by a login request that carries a very long username.
ReportedSupported2 sources— sign in to open View cited source
[8]
"At this time, there is no indication that this vulnerability has been exploited in the wild," the notice said.
ReportedSupportedSource: Check Point notice on its CheckMates community, September 16, 20262 sources— sign in to open View cited source
[9]
The U.S. Cybersecurity and Infrastructure Security Agency recorded exploitation as "none" in its assessment attached to the CVE record on September 17.
ReportedSupported2 sources— sign in to open View cited source
[10]
The flaw was not in CISA's Known Exploited Vulnerabilities catalog as of the catalog's September 16 release, which The Hacker News checked on September 17.
ReportedSupported2 sources— sign in to open View cited source
[11]
Censys said no public proof-of-concept exploit existed as of September 16.
ReportedSupported2 sources— sign in to open View cited source
[12]
Aviv Abramovich, vice president of product management for network security at Check Point, told The Hacker News that the company had not received any reports of exploitation.
ReportedSupported2 sources— sign in to open View cited source
[3]
The Security Management Server is the system that controls firewall policy and administrator access.
ReportedSupportedView cited source
[5]
Check Point told The Hacker News that the vulnerable path runs only through the Trusted Clients setting, which controls which hosts may connect to the management server through SmartConsole.
ReportedSupportedView cited source
[6]
Check Point's guidance says that whether or not the fix is installed, administrators should check that management Trusted Clients access is limited to known, trusted hosts and is not set to any IP address, and should not expose management access directly to the internet.
ReportedSupportedView cited source
[7]
Check Point said in a notice on its CheckMates community on September 16, 2026, that customers with automatic updates enabled are already protected, that everyone else should apply the LivePatch fix described in advisory sk1000155, and urged customers to take immediate action because of the flaw's severity and potential impact.
ReportedSupportedView cited source
[13]
Check Point's CVE record lists the affected branches by Jumbo Hotfix Take, the numbered level of the update package that collects the fixes for a release, and a server on a listed branch at the listed Take or older is affected: R82.10 with Take 44 or below, R82 with Take 126 or below, R81.20 with Take 166 or below, R81.10 with Take 190 or below, and R81, R80.40, R80.30, R80.20, R80.10 and R80, all end of support.
ReportedSupportedView cited source
[16]
Abramovich said standalone deployments, which run management and gateway on one system, Log Servers and Multi-Domain servers are also vulnerable.
ReportedSupportedView cited source
[17]
Check Point has a fix ready for the out-of-support versions, Abramovich said, and customers who need it should log a ticket with Check Point support.
ReportedSupportedView cited source
[18]
An alert from NHS England Digital, citing sk1000155, says the hosted Smart-1 Cloud service is not affected because the fix is already in place there.
ReportedSupportedView cited source
[19]
"Automatic updates" means the setting described in sk175504: the SmartConsole checkbox under Global Properties and Data Access Control labeled "Automatically download and install Software Blade Contracts, security updates, and other important data (highly recommended)," followed by the installation of the Access Control policy. LivePatch is the channel Check Point uses to push urgent security fixes to systems where that option is turned on.
ReportedSupportedView cited source
[20]
Check Point says that if automatic updates are enabled, administrators should confirm the fix has been installed rather than assume it, and that the cplp list command shows which LivePatches are installed and their status.
ReportedSupportedView cited source
[21]
When Check Point pushed fixes for two VPN certificate flaws last week, several customers wrote in its community that the automatic package had not reached their systems on the day of the announcement.
ReportedSupportedView cited source
[d3]
The dated non-exploitation statements in the record fall on September 16 and September 17, 2026.
DerivedSupported2 sources— sign in to open
[d1]
A management server whose Trusted Clients list is set to any IP address and whose management access is reachable from the internet exposes the pre-authentication login handler to any host that can route to it.
DerivedSupported1 source— sign in to open
[d2]
An inventory checked only against the branches listed in the CVE record returns "not affected" for R82.20 servers that Check Point's own product VP and Censys describe as vulnerable.
DerivedSupported1 source— sign in to open
[14]
The CVE record does not list R82.20, but Abramovich said R82.20 is also vulnerable.
ReportedContested2 sources— sign in to open View cited source
[15]
Censys said in its advisory that every R82.20 build is affected and that no Jumbo Hotfix yet protects that branch.
ReportedContested2 sources— sign in to open View cited source

Sources

Publishers with included, body-backed reporting in this cluster.

thehackernews.com
1 article · September 17, 2026
Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root

Ask Clarity

Have a question this piece left open? The answer comes from its reporting and claim ledger — nothing else.

Try

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

This is written for whoever runs the console. The exploit detail stops at Censys's note that a very long username triggers the overflow, so there is no reproduction path here. What a builder can use is the version table: branches are keyed to Jumbo Hotfix Take numbers, and a server at the listed Take or older is affected. R82.20 is absent from Check Point's CVE record even though the company's own network security product VP says it is vulnerable and Censys says every build of it is. Any inventory check written against that record will pass those servers.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence74

0100

Vendor documents plus one named executive

Every fact here traces to something a reader can open: Check Point's CheckMates notice of September 16, its CVE record, advisory sk1000155, the hardening guide, a Censys advisory, CISA's assessment of September 17 and an NHS England Digital alert. Aviv Abramovich, Check Point's vice president of product management for network security, is quoted by name on the scope the record omits. The limit is who supplied what: the 9.8 rating and the affected-branch list are both the vendor's, and one outlet did all the checking.

Adoption38

0100

Fix published, uptake uncounted

The fix exists and has a delivery channel, and the hosted Smart-1 Cloud service already carries it according to NHS England Digital. Nobody has counted how many customer-run servers took it. Censys puts 3,836 hosts worldwide presenting the default identity of a Check Point management or log server and says the number is "total role presence, not a confirmed-vulnerable count," because scan data does not show build or hotfix level. Last week's VPN certificate fixes reached some customers late. That is the reason the vendor now asks administrators to check with cplp list.

Hype gap+5

−100 understated0 aligned+100 overstated

Near aligned, with the vendor on both sides

Root code execution before authentication is as severe as a management-plane flaw gets, and the reporting keeps it next to four statements that nobody has been attacked and to Check Point's narrowing of the reachable path to the Trusted Clients setting. Pushing the other way, the affected-branch list is one branch short of what the same company says in interview, so the vendor's published scope understates its own position while its 9.8 sets the headline.

Incentives58

0100

Vendor sets the score and the scope

Check Point assigned the CVSS score, wrote the affected-version list and chose the fix channel. It also supplied the executive who is the only person on record that R82.20, Log Servers and Multi-Domain servers are exposed. Censys sells internet-wide scanning and published the host count that gives the story scale, with its own caveat attached to it. The vendor's call for immediate action and the scanning company's refusal to treat 3,836 hosts as vulnerable pull in opposite directions, and the reporting prints both.

Confidence66

0100

Dated and attributed, single newsroom

Names and dates are attached to nearly everything, which is what makes the version discrepancy stand out: it is a conflict inside one vendor's own material, and with a single outlet on the story there is no second check on which branches are actually covered by a Jumbo Hotfix. Patch delivery is the softest part of the record, documented only through customer posts about last week's VPN certificate fixes and a community admin's guess that the rollout was staged.

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

Topics

security
Check Point patches two 9.8 VPN certificate flaws without naming what triggers them
5 publishers
build
An ASN.1 heap overflow puts Check Point management servers in the same patch window as the gateways
1 publisher
build
Check Point ships this week's VPN fix as a live patch for three versions and an upgrade for the rest
1 publisher
security
Plex tells NAS owners to hand-install a security release it will not describe
3 publishers

Unauthenticated attackers can run code as root on Check Point's Security Management Server

What happened

Why it matters

What to watch

Claim ledger

Sources

Topics and entities

Topics

Entities

Claim ledger

Topics and entities

Topics

Entities

Perspective Coverage

Reality

Sources

What happened

Why it matters

What to watch

Claim ledger

Sources

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Related stories

Claim ledger

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Perspective Coverage

Reality

Related stories

Sources