CVE-2026-91843, Check Point Security Management / Multi-Domain Security Management / Log Server: unauthenticated stack overflow in the login process reaches root RCE (CVSS 9.8)

Check Point disclosed CVE-2026-91843 (CVSS 9.8) on 2026-09-16: a stack overflow in the unauthenticated login process to Check Point Security Management Server, Multi-Domain Security Management Server, Log Server and Multi-Domain Log Server lets an attacker who reaches the login interface run arbitrary code remotely as root (Check Point PSIRT, 2026-09-16). Check Point's attack indicator is a failed administrator login for an over-long username (Check Point PSIRT, 2026-09-16). Neither Check Point's advisory nor CERT-FR reports observed exploitation (Check Point PSIRT, 2026-09-16 · CERT-FR CERTFR-2026-AVI-1193, 2026-09-17).

Check Point ships the fix as a LivePatch: administrators with automatic updates enabled per sk175504 are already protected, and cplp list in Expert mode should show the CVE-2026-91843 patch armed on R82.20, R82.10, R82 and R81.20 (Check Point PSIRT, 2026-09-16). The fix is also in the Jumbo Hotfix Accumulator for R82.20 from Take 10, R82.10 from Take 45, R82 from Take 127, R81.20 from Take 170 and the end-of-support R81.10 from Take 192, while Check Point lists no fix for R80.x and R81 (Check Point PSIRT, 2026-09-16). Check Point's mitigation is to limit Trusted Clients (GUI clients) to trusted IP addresses or subnets and never to use "Any" as the client type (Check Point PSIRT, 2026-09-16). The flaw needs no credentials and yields root (Check Point PSIRT, 2026-09-16), so the absence of exploitation reports does not lower the urgency.

Triage: Check Point's advisory for CVE-2026-93616 treats a login with a username over 1,000 characters that coincides with an FWM or MDS core dump as a potential attempt to exploit that flaw (Check Point Support, sk1000171, 2026-09-20). For CVE-2026-91843, Check Point gives only the "Username too long" login failure as its attack indicator (Check Point PSIRT, 2026-09-16).