CVE-2026-91843 is a critical stack-based buffer overflow vulnerability in the login process of Check Point Security Management Server and Log Server, which manage firewalls and log collection. Exploitation allows remote attackers without privileges to gain root code execution with low complexity and no user interaction. The vulnerability affects all deployments regardless of configuration or VPN usage. Check Point released patches and temporary mitigations such as restricting access to trusted clients and system hardening. Detection can be done by monitoring for 'Administrator failed to log in: Username too long' alerts in audit logs. While no active exploitation is confirmed, the vendor warns of the critical nature and recommends immediate patching.

Successful exploitation results in remote code execution with root privileges on management systems, potentially allowing full control over Check Point Security Management Server and Log Server. This could compromise firewall management and log integrity, severely impacting network security operations. The vulnerability requires no user interaction and can be exploited remotely by unauthenticated attackers, increasing the risk and ease of attack.

Check Point has released official security updates to fix this vulnerability. Customers unable to immediately apply patches can implement temporary mitigations by hardening vulnerable systems and restricting access to trusted IP addresses or subnets via the SmartConsole dashboard under Manage & Settings > Permissions & Administrators > Trusted Clients. Monitoring audit and admin login logs for 'Administrator failed to log in: Username too long' alerts can help detect exploitation attempts. Applying the vendor's LivePatch or full security update is strongly recommended to fully remediate the issue.