Critical Check Point R80 Vulnerability Lets Attackers Gain Root Access

Key Takeaways

• A critical stack-based buffer overflow vulnerability (CVE-2026-91843) has been discovered in Check Point R80 and later security management and logging systems.
• The flaw allows unauthenticated remote attackers to execute arbitrary code with root privileges.
• The vulnerability carries a CVSS 3.1 score of 9.8, indicating extreme severity and ease of exploitation.
• Affected products include Security Management Server, Multi-Domain Security Management Server, Log Server, and Multi-Domain Log Server across multiple R80-R82.20 versions.
• Check Point has released an urgent security fix via LivePatch and offline packages; immediate application is strongly advised.

Critical Flaw Grants Root Access to Check Point Systems

Check Point has issued an urgent security update addressing CVE-2026-91843, a critical stack-based buffer overflow vulnerability that poses a significant risk to its security management and logging systems. This flaw could enable an unauthenticated remote attacker to execute arbitrary code with root privileges, severely compromising affected environments.

Assigned a CVSS 3.1 score of 9.8, the vulnerability is classified as critical due to its network-accessible nature, requiring minimal attack complexity, no prior privileges, and no user interaction for successful exploitation. This high score underscores the urgency of remediation for all affected organizations.

Exploitation Mechanism and Impact

The vulnerability specifically manifests during the login process. An attacker can trigger a stack overflow by submitting an excessively long username, even before authentication is completed. This pre-authentication vulnerability significantly broadens the attack surface.

Successful exploitation grants the adversary the highest level of operating system control, known as root access. This level of compromise could expose sensitive management data, security policies, administrator credentials, and collected logs. Furthermore, gaining root access could serve as a launchpad for deeper intrusions into the protected network infrastructure.

While Check Point has not publicly detailed the specific exploit chain or confirmed any in-the-wild attacks, the potential for severe impact necessitates immediate attention from administrators.

Affected Products and Versions

The vulnerability impacts several core Check Point products, including the Security Management Server, Multi-Domain Security Management Server, Log Server, and Multi-Domain Log Server. Specific vulnerable releases are:

• R82.20
• R82.10 with Jumbo Hotfix Take 44 or earlier
• R82 with Take 126 or earlier
• R81.20 with Take 166 or earlier
• End-of-support R81.10 with Take 190 or earlier
• End-of-support R80 through R80.40 and R81

According to the advisory published by Check Point, Smart-1 Cloud environments are not vulnerable, as the necessary correction has already been deployed to those systems.

Indicators of Compromise and Remediation

Organizations should review their SmartConsole Audit and Admin login records for the message “Administrator failed to log in: Username too long.” While this entry may indicate an attempt to exploit the flaw, it does not confirm successful root-level compromise. Incident response teams should conduct thorough investigations of surrounding activity, preserving relevant source IP addresses, timestamps, administrator login events, configuration changes, and any unusual processes on management servers for detailed analysis.

Check Point has released the fix through its LivePatch system. Customers with automatic security updates enabled under sk175504 should receive the protection automatically. However, administrators are strongly advised to verify the successful deployment of the patch rather than assume coverage.

For systems that require manual updates, offline packages are available as urgent security update Take 29 for R82.20 and Take 28 for R82.10, R82, and R81.20. The LivePatch or corresponding offline package must be installed across all affected Security Management, Multi-Domain Security Management, and Log Servers.

To confirm protection, administrators can enter Expert mode on each management or log server and execute the command cplp list. A properly protected system will display the fwm:fwm patch in “armed” status with “livepatch” mode and include CVE-2026-91843 in the comment field.

What You Should Do

• Immediately Apply Patches: Deploy the LivePatch or appropriate offline package (Take 29 for R82.20; Take 28 for R82.10, R82, R81.20) to all affected Security Management, Multi-Domain Security Management, and Log Servers.
• Verify Patch Deployment: After applying updates, run cplp list in Expert mode on each server to confirm the fwm:fwm patch is in “armed” status with “livepatch” mode and references CVE-2026-91843.
• Restrict SmartConsole Trusted Clients: Until remediation is confirmed, limit SmartConsole Trusted Clients to specific, approved IP addresses or subnets via Manage & Settings, Permissions & Administrators, and Trusted Clients. Avoid selecting “Any” as the client type.
• Monitor Logs for Anomalies: Actively search SmartConsole Audit and Admin login records for “Administrator failed to log in: Username too long” messages, and investigate any associated activity thoroughly.
• Prioritize Unsupported Systems: For end-of-support versions, migrate to a supported branch as a priority. However, this migration should not delay the application of available fixes to current systems.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.