How a Pre-Authentication Stack Overflow in Check Point Log Servers Leads to Root Code Execution
A pre-authentication bug with root consequences
CVE-2026-91843 affects the login path of Check Point Security Management and Log Servers. The vulnerable code runs before any credential check, so an unauthenticated attacker who can reach the service can trigger it. CERT-In recorded the issue as CIVN-2026-0465 with a CRITICAL severity rating.
Attack path
- The attacker reaches the management or log server login service over the network.
- A crafted request is sent to the login process.
- A stack overflow corrupts control data on the stack.
- Execution is redirected, and the attacker runs arbitrary code as root. No authentication step stands between the attacker and the vulnerable parsing routine. That is what makes the flaw more dangerous than a post-authentication privilege escalation.
Why root on these servers matters
Security Management and Log Servers are the control plane of a Check Point deployment. They define policy, hold gateway configuration and store security events. Root on such a host allows policy changes, log manipulation and lateral movement toward managed gateways.
Affected releases
The flaw covers Security Management Server, Multi-Domain Security Management Server, Log Server and Multi-Domain Log Server across R82.20, R82.10 Jumbo Hotfix Take 44 or prior, R82 Jumbo Hotfix Take 126 or prior, R81.20 Jumbo Hotfix Take 166 or prior, R81.10 Jumbo Hotfix Take 190 or prior (end of support), and the end-of-support R80/R80.10/R80.20/R80.30/R80.40/R81 trains.
Fix and hardening
Install the vendor updates referenced by advisory sk1000155. Until patching completes, limit exposure of the login service, apply network access controls to management interfaces, and review logs for anomalous login attempts.
Sources
- CERT-In Vulnerability Note CIVN-2026-0465
- Check Point advisory sk1000155
Top comments (0)