CVE-2026-91843 Stack Overflow Enables Pre-Auth Root RCE on Check Point Management Servers

The vulnerability resides in the pre-authentication login handler of affected Security Management Servers. A long username in the initial request overflows the stack buffer, bypassing the Trusted Clients IP restriction that Check Point claimed limited exposure. Check Point issued LivePatch fixes via sk1000155 for branches R82.10 Take 44 and below, R82 Take 126 and below, R81.20 Take 166 and below, and R81.10 Take 190 and below; R82.20 remains unpatched per Censys scans. End-of-support releases R81, R80.40 through R80 require support tickets for the fix. CISA recorded no known exploitation on September 17 while noting the flaw's absence from the KEV catalog.

Censys internet-wide scans identified thousands of exposed management interfaces, many with Trusted Clients set to any or overly broad ranges. The pattern matches prior management-plane exposures where vendors relied on network segmentation assumptions that fail against direct internet reachability or compromised internal hosts. Check Point statements emphasize no in-the-wild exploitation reports, yet the high severity and root impact warrant treating the absence of evidence as a detection gap rather than confirmation of safety.

Administrators must verify LivePatch installation with the cplp list command rather than assuming automatic updates succeeded. Hardening steps include restricting Trusted Clients to explicit management IPs and never exposing SmartConsole ports to untrusted networks. Standalone, Multi-Domain, and Log Server deployments share the same code path and require identical remediation. Continued monitoring of Censys and Shodan for new public PoCs is required given the flaw's simplicity.