CVE-2026-91843 Overview
CVE-2026-91843 is a stack-based buffer overflow [CWE-121] that occurs during the unauthenticated login process of an affected Check Point product. An attacker can trigger the overflow over the network without credentials or user interaction. Successful exploitation allows arbitrary code execution with root privileges on the target system.
The vulnerability carries a CVSS 3.1 base score of 9.8 and is reachable pre-authentication, placing any exposed instance at direct risk. Check Point published a security advisory (sk1000155) with fixed versions and remediation guidance.
Critical Impact
Unauthenticated remote attackers can execute arbitrary code as root, resulting in full compromise of the affected device.
Affected Products
- Check Point product referenced in advisory sk1000155 (see vendor advisory for exact versions)
- Deployments exposing the vulnerable login service to untrusted networks
- Instances that have not applied the vendor-supplied hotfix
Discovery Timeline
- 2026-09-16 - CVE-2026-91843 published to NVD
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-91843
Vulnerability Analysis
The flaw is a stack-based buffer overflow reachable during the pre-authentication login handshake. Because the vulnerable code path executes before credential validation, no valid account is required to reach it. Reaching a memory corruption primitive on an unauthenticated network surface is the worst-case exposure class for an appliance.
Successful exploitation corrupts the call stack and diverts execution to attacker-controlled data. The service runs with root privileges, so code execution inherits full administrative control of the underlying operating system. That control extends to configuration files, cryptographic material, tunnel state, and any traffic transiting the device.
Root Cause
The root cause is classified under [CWE-121] Stack-based Buffer Overflow. A fixed-size stack buffer receives attacker-supplied input from the login flow without adequate length validation. When the input exceeds the buffer size, adjacent stack data including saved return addresses is overwritten.
Attack Vector
The attack vector is Network with low complexity, no privileges, and no user interaction required. An attacker sends a crafted request to the login endpoint of an exposed instance. The oversized field overwrites saved control data on the stack and redirects execution to attacker-supplied code or a return-oriented programming chain. See the Check Point Security Advisory for vendor-confirmed technical details.
Detection Methods for CVE-2026-91843
Indicators of Compromise
- Unexpected crashes, restarts, or core dumps in the login or authentication service on the affected appliance
- New root-owned processes, cron entries, or SSH keys appearing after inbound connections to the login service
- Outbound connections from the appliance to unfamiliar hosts shortly after login-service traffic spikes
- Anomalous login-service requests containing unusually large field lengths or malformed authentication payloads
Detection Strategies
- Inspect network telemetry for oversized payloads directed at the login endpoint from untrusted sources
- Correlate login-service process crashes with inbound connections in the same time window
- Alert on any interactive shell, package installation, or configuration change originating from the login service process tree
- Baseline expected outbound traffic from the appliance and flag deviations
Monitoring Recommendations
- Forward appliance system, authentication, and crash logs to a centralized analytics platform for retention and correlation
- Enable network flow logging on segments where the appliance is exposed and retain for incident review
- Monitor vendor advisory sk1000155 for updates to affected versions and fix availability
How to Mitigate CVE-2026-91843
Immediate Actions Required
- Apply the fixed version identified in Check Point advisory sk1000155 on every affected appliance
- Restrict network access to the login/management interface to trusted administrative networks only
- Audit affected devices for signs of prior exploitation, including unexpected root processes and configuration drift
- Rotate credentials, API keys, and certificates stored on any device suspected of compromise
Patch Information
Check Point published remediation guidance in advisory sk1000155. Refer to the Check Point Security Advisory for the current list of fixed versions and upgrade instructions. Prioritize internet-exposed instances first, then internal deployments.
Workarounds
- Block untrusted network access to the login service using upstream firewall rules or ACLs until patching is complete
- Place the management interface behind a VPN or bastion host reachable only by administrators
- Disable or rate-limit exposure of the vulnerable login endpoint where operationally feasible
- Monitor the appliance for crash and restart events while workarounds are in place
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.