Check Point management: another unauthenticated root path, confirm the LivePatch

Check Point shipped a LivePatch for a 9.8 on the management server. The CVE is CVE-2026-91843. The bug is a stack overflow in the login path, which runs before anyone has a password. Censys described the trigger as a username that is far too long. We are not going to decorate that sentence. Check Point says there is no sign it has been used. CISA recorded exploitation as none. Censys said it had not seen a public proof of concept as of September 16. Believe that for now. Also notice the pattern.

What is in scope

Security Management Server, Log Server, Multi-Domain, and standalone boxes that run management and gateway together. Smart-1 Cloud is the exception: NHS England, citing Check Point's sk1000155, said the hosted service already has the fix. On-prem is the work.

Affected takes, from the CVE record: R82.10 at Jumbo 44 or older, R82 at 126 or older, R81.20 at 166 or older, R81.10 at 190 or older, and a tail of end-of-support branches (R81 back through R80). Check Point later told The Hacker News that R82.20 is vulnerable too, and Censys said no Jumbo on that branch covers it yet. If you are on R82.20, do not take comfort from a list that forgot you.

Check Point also said the path only works when Trusted Clients is in play, the control that decides which hosts may talk to the management server through SmartConsole. That is not the same as "we are fine because we have a password." It is "we are fine if the only hosts allowed to reach login are ones we named." Any-IP on that list is the opposite of a named host.

The fifth critical one since July

THN counted this as the fifth critical, unauthenticated reach into Security Management since July 22. CVE-2026-16232 (SmartConsole bypass) was exploited in July and landed on KEV the same day. Check Point said then that the ugly cases were management left on the internet with no IP restrictions. CVE-2026-62144 was another bypass that same week, not reported as used. August brought CVE-2026-18574. September 9 brought CVE-2026-85103, a heap overflow in VPN certificate decoding that also reaches Quantum management. The company said it found the last two internally and had no exploitation reports. This week's overflow is another login-path problem. The lesson is not a new product name. It is that the management plane keeps showing up.

Do not assume automatic updates saved you

The fix rides LivePatch. Advisory sk1000155. If the SmartConsole box for automatic updates is on (the setting in sk175504), Check Point says you should already have it. Customers said the opposite last week when two VPN certificate fixes rolled out in stages. Confirm with cplp list. A checkbox is not a patch report.

End-of-support branches still have a fix if you open a ticket. That is a courtesy, not a strategy. If you are on R80.x, the overflow is one item on a longer list that starts with "this release is done."

What we would check today

• Apply sk1000155 on every Security Management Server and Log Server, then read cplp list instead of trusting the community thread.
• Trusted Clients: named hosts, not any IP. Management access through a VPN, not a public interface. That was the July advice and it is still the September advice.
• Search audit and admin-login logs for "Administrator failed to log in: Username too long." Check Point published that string as the breadcrumb. A hit is a ticket, not a curiosity.
• If you are on R82.20, treat "no Jumbo listed" as "still open" until Check Point gives that branch a take you can name.

Bottom line

A management server with an unauthenticated root path is the firewall's brain, not a nice-to-have appliance. Forensic Five reviews the devices that write policy, not only the ones that pass traffic. From St. Albert, Alberta. Install the LivePatch. Then prove Trusted Clients is not a welcome mat.