CVE-2026-91843 Explained: Attack Path, Affected Builds and Hardening Steps

What the vulnerability is

CVE-2026-91843 is a critical stack overflow in Check Point Security Management and Log Servers. CERT-In assigned it note CIVN-2026-0465 and a CRITICAL rating. The overflow is triggered through the login process before authentication, and successful exploitation results in arbitrary code execution as root.

Exploitation conditions

• Network reachability to the management or log server login service.
• Ability to send a crafted request to the login handler.
• No valid credentials required, because the vulnerable code runs pre-authentication.

Impact

Root compromise of a management or log server undermines the control plane of the Check Point deployment. An attacker could modify security policy, suppress or alter logging, and move toward managed gateways.

Affected scope

The issue covers Security Management Server, Multi-Domain Security Management Server, Log Server and Multi-Domain Log Server on R82.20, R82.10 Jumbo Hotfix Take 44 or prior, R82 Jumbo Hotfix Take 126 or prior, R81.20 Jumbo Hotfix Take 166 or prior, R81.10 Jumbo Hotfix Take 190 or prior (end of support), and the end-of-support R80 through R81 releases.

Remediation and mitigation

Apply the fixed builds from Check Point advisory sk1000155. In the interim, constrain management and log server access to trusted hosts, watch for abnormal login attempts, and plan upgrades off end-of-support versions.

Sources

• CERT-In Vulnerability Note CIVN-2026-0465
• Check Point advisory sk1000155