Check Point CVE-2026-91843: Unauthenticated Root RCE Response Guide

A CVSS 9.8 pre-auth RCE is serious on any system, but a Security Management or Log Server is not just another host — it holds the policy database, admin credentials, and (for Multi-Domain deployments) the configuration for every gateway it manages. Root access to the management server is functionally root access to the organization's entire Check Point-managed security posture: an attacker in that position can rewrite firewall policy, harvest credentials used to manage gateways, or quietly disable logging before pivoting further.

This is also the fifth critical management-plane-adjacent flaw Check Point has disclosed in roughly two months, following the CVE-2026-16232 SmartConsole auth-bypass and the September 9 VPN-certificate pair (CVE-2026-85102 and CVE-2026-85103, both CVSS 9.8, unauthenticated RCE via malformed VPN certificate ASN.1 decoding on Security Gateways). Track this as part of that same client-facing pattern rather than an isolated one-off.

Because the flaw sits in the unauthenticated login path, exposure is determined purely by whether a vulnerable role is deployed and reachable — no account or prior access is needed to reach the trigger.

• •Inventory every Security Management Server, Multi-Domain Security Management Server, Log Server, and Multi-Domain Log Server and confirm the running version/take against Check Point advisory sk1000155
• •Check whether automatic (CPUSE) updates are enabled on each server — Check Point states these were already protected as of the September 16 disclosure
• •Confirm which management/log servers are reachable from outside the trusted admin network — remote or partner-managed deployments are the priority
• •Note this is distinct from the September 9 VPN-certificate flaws (CVE-2026-85102/85103), which hit Security Gateways, not the management servers — a site can be exposed to one, both, or neither depending on its topology

Check Point shipped this as a LivePatch specifically so it can be applied without a full upgrade cycle — there is no reason to defer it behind a normal change window given the pre-auth, no-account-needed trigger.

• •Apply the LivePatch for your track: R82.20 Take 29, R82.10 Take 28, R82 Take 28, or R81.20 Take 28, per sk1000155
• •If CPUSE automatic updates were already enabled, verify the patch actually landed rather than assuming protection — confirm the applied take number on each server
• •Where LivePatch cannot be applied immediately, restrict network reachability to the management/log server's login interface to trusted admin IP ranges only, as a stopgap
• •Review management-server authentication and process logs for login attempts with abnormally long usernames or crash/restart events around the exposure window
• •Treat any server showing signs of compromise as a full incident under your IR plan — see our ransomware IR playbook for the same NIST SP 800-61 containment-and-recovery structure

CISA's September 17 assessment recorded no confirmed in-the-wild exploitation, so this has not (yet) landed on the Known Exploited Vulnerabilities catalog the way the Cisco Secure Email Gateway flaw did. That is not the same as low risk: a pre-auth, no-account-needed stack overflow against a security management server is exactly the profile that tends to get weaponized quickly once technical details circulate, and Check Point's own decision to ship an emergency same-day LivePatch — rather than folding the fix into a scheduled release — reflects that assessment. Organizations in regulated sectors (BFSI, healthcare) should also expect CERT-In and sector regulators to treat an unpatched, publicly disclosed CVSS 9.8 as a 'known and preventable' gap in any subsequent incident review, independent of KEV status.

The 'patch now, before it becomes a KEV entry' framing above has partly played out — not for CVE-2026-91843 itself, but for the companion September 9 Security Gateway flaw referenced above. On September 22, CISA added CVE-2026-85102 (the VPN-certificate pre-auth RCE on Security Gateway) to the KEV catalog after observing exploitation attempts against Check Point Spark customers globally, even though a fix has been available since September 9. The same September 22 update also added a newly disclosed pre-auth path-traversal zero-day in the Check Point Management web service, CVE-2026-93616, which lets an unauthenticated attacker execute a script from an arbitrary path and load an arbitrary Java class — a fix is already available. Both entries carry a federal BOD 26-04 remediation deadline of September 25, 2026. CVE-2026-91843 itself remains unconfirmed for in-the-wild exploitation as of this update, but any site still unpatched against the September 9 Security Gateway pair should treat that gap as materially more urgent than a day ago.