Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Check Point Security Management and Log Servers stack overflow security flaw (CVE-2026-91843)

Vulnerability
First reported
Last updated
Happening score
H score 46
2 unique sources, 2 articles

Summary

Hide ▲

Check Point Security Management Server and Log Server deployments are affected by CVE-2026-91843, a critical stack-based buffer overflow in the login process that can let an unauthenticated attacker achieve root remote code execution. Check Point says the flaw is not flagged as actively exploited, has released a LivePatch fix, and advises restricting Trusted Clients to known hosts or trusted IP addresses/subnets. The latest scope update says R82.20, standalone deployments, Log Servers, and Multi-Domain servers are also vulnerable, and out-of-support customers should open a ticket with Check Point support.

Related Happenings

Check Point Management Server directory traversal/file upload zero-day (CVE-2026-93616)

Vulnerability
H score45 First: 23.09.2026 09:14 Last: 23.09.2026 09:14 Sources 1

About this happening: Check Point issued urgent fixes for CVE-2026-93616, a critical zero-day in Management Server products that is being exploited in the wild. The flaw is a dire...

Open Happening

Check Point Security Gateways and Security Management Server VPN certificate flaws (multiple vulnerabilities)

Vulnerability
H score53 First: 10.09.2026 14:45 Last: 10.09.2026 14:45 Sources 1

About this happening: Check Point Security Gateways and Security Management Server are affected by two critical VPN certificate flaws, CVE-2026-85102 and CVE-2026-85103, that can let an...

Latest development: 23.09.2026 22:53

Check Point observed a wave of exploitation attempts against Spark customers starting September 12, 2026, with attackers using VPN services and proxies to hide their location.

Open Happening

Check Point VPN certificate mitigation guidance

Advisory/Mitigation
H score53 First: 10.09.2026 14:45 Last: 10.09.2026 14:45 Sources 1

About this happening: Check Point directed affected customers to Live Patch or the latest Jumbo Hotfix for its VPN certificate flaws, with rollout beginning on September 9. The guidance...

Open Happening

SmartConsole actively exploited authentication bypass (CVE-2026-16232)

Vulnerability
H score43 First: 23.07.2026 11:13 Last: 23.07.2026 11:13 Sources 1

About this happening: Check Point addressed CVE-2026-16232, a zero-day authentication bypass in SmartConsole affecting Security Management and Multi-Domain Management products....

Open Happening

Check Point Remote Access VPN and Mobile Access authentication bypass (CVE-2026-50751)

Vulnerability
H score47 First: 08.06.2026 16:05 Last: 08.06.2026 16:05 Sources 1

About this happening: Check Point warned that CVE-2026-50751 is a critical authentication bypass in Remote Access VPN and Mobile Access deployments using deprecated IKEv1, letti...

Open Happening

Timeline

  1. 18.09.2026 03:00 1 articles · 13d ago

    Check Point confirms broader vulnerable versions and deployment types

    Campaign Scope Update

    Check Point confirms that R82.20, standalone deployments, Log Servers, and Multi-Domain servers are vulnerable, and says customers who need fixes for out-of-support versions should open a ticket with Check Point support.

    Show sources
    Open in new tab
  3. 16.09.2026 03:00 2 articles · 15d ago

    Check Point discloses CVE-2026-91843 in Security Management and Log Servers

    Initial Disclosure

    Check Point discloses CVE-2026-91843 in Security Management and Log Servers, a critical network-reachable stack overflow in the login process that can let an unauthenticated attacker run code as root, and says customers with automatic updates enabled are already protected while everyone else should apply the LivePatch fix in sk1000155 immediately.

    Show sources
    Open in new tab
  4. 16.09.2026 03:00 2 articles · 15d ago

    Trusted Clients path and long username trigger the stack overflow

    Technical Analysis Update

    Check Point says the vulnerable path runs only through the Trusted Clients setting that controls which hosts may connect through SmartConsole, and Censys says the stack overflow is triggered by a login request carrying a very long username.

    Show sources
    Open in new tab