Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root

Check Point released a LivePatch for CVE-2026-91843, a CVSS 9.8 stack overflow that can let unauthenticated attackers execute code as root on Check Point Security Management Server and Check Point Log Servers through Trusted Clients access. The issue affects R82.10 with Jumbo Hotfix Take 44 or below, R82 with Jumbo Hotfix Take 126 or below, R81.20 with Jumbo Hotfix Take 166 or below, R81.10 with Jumbo Hotfix Take 190 or below, and all R82.20 builds; older R81, R80.40, R80.30, R80.20, R80.10 and R80 branches are also affected. Check Point reports no known exploitation, but administrators should install the fix, verify its status, and restrict Trusted Clients to known hosts rather than exposing management access to the internet.