CVE-2026-91843

Stack overflow in login process to the Security Management and Log Servers

No known exploitation. EPSS puts it in the 44th percentile. No fix published yet.

CVSS 3.19.8Critical EPSS percentile44th0.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Check it yourself

OpenVAS · 1 check

e.g. OID 1.3.6.1.4.1.25623.1.0.158007

Run the check

Published 2026-09-16Updated 2026-09-18Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

checkpoint Quantum Security ManagementAffected: R82.10 with Jumbo Hotfix Take 44 or belowUpgrade to: not statedAffected: R82 with Jumbo Hotfix Take 126 or belowUpgrade to: not statedAffected: R81.20 with Jumbo Hotfix Take 166 or belowUpgrade to: not statedAffected: R81.10 (EOS) with Jumbo Hotfix Take 190 or belowUpgrade to: not stated + 6 more branchesStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether you run quantum security management Security Management or Log Servers and whether their login interface is reachable from untrusted networks.
Restrict access to the login interface immediately to trusted administrator networks or a VPN using firewall rules.
Contact the vendor for the fixed version for CVE-2026-91843; no fixed version has been published in the available findings.
Review server activity for unexpected commands, new accounts, or configuration changes after limiting access.

May need vendor or contractor work

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

Coverage timeline

4 publishers

Technical analysis published
as reported · Oct 1, 2026·Bishop Fox summary
Check Point, Tanium, and Kaspersky patched multiple severe vulnerabilities, including an unauthenticated RCE in Check Point management servers, with no evidence of in-the-wild exploitation for the new flaws.
as reported · Sep 18, 2026·BleepingComputer summary

Sourced from public security reporting — each date is when it was published, not when it happened. 4 further articles named this CVE in wider roundups without reporting it as a distinct event.

What it is

From the CVE record

A stack overflow during the unauthenticated login process may allow an attacker to run arbitrary code remotely with root privileges.

In plain language

Written by AI from the record

A flaw in quantum security management lets an outsider take over its Security Management and Log Servers without signing in, so affected businesses should restrict access now because no fix information is available.

Unauthenticated remote root command execution is possible through a stack-based buffer overflow triggered by a crafted or overly long login request.

If you're affected

Full server takeover
Security log tampering
Network-wide disruption
Sensitive data exposure
Ransomware risk

What is it

This is a defect in the server's sign-in process that can let an outsider make the server run their commands. It is like a locked office door that can be forced open with an oversized key, giving the intruder control of the building rather than just access to the lobby.

Who is affected

This matters to you if you use or run quantum security management Security Management or Log Servers. It is a risk when an attacker can reach the server's login interface over the network; they do not need an account or anyone to click anything.

How urgent is it

This is urgent because an attacker can take full control of the server remotely without logging in. There is no confirmed active exploitation or public exploit code in the available findings, but the impact and ease of remote access justify immediate access restrictions while awaiting vendor fix information.

What to do — in detail

Confirm exposure by identifying all quantum security management Security Management and Log Servers, then test their network reachability to the login service from untrusted network segments. No vendor fixed version or supported-version branch guidance is available in the findings, so obtain the official remediation version and upgrade instructions directly from the vendor before scheduling an upgrade.

If patching is delayed, place the login interface behind firewall rules that allow only designated administrator networks or VPN addresses; remove public and broadly internal access. Review server and authentication-service logs for unusually long login attempts, crashes, unexpected command execution, new privileged accounts, altered security policies, and configuration changes. CVE-2026-91843 is not listed in CISA KEV, so no CISA remediation due date applies.

Technical context

CVE-2026-91843 is rated CVSS 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. It is CWE-121, a stack-based buffer overflow in the unauthenticated login path: a crafted or excessively long input packet can corrupt control flow and result in remote code execution as root. The affected Security Management and Log Servers are reachable in the default configuration when network-accessible. CISA KEV does not list this CVE; reporting states there is no evidence or indication of in-the-wild exploitation, and no public exploit code is on record. EPSS is 0.5% (42nd percentile) with a flat trend.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS44th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.5% chance of exploitation activity in the next 30 days, which ranks it in the 44th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

8 events over 36 days, from the signal feeds we watch.

2026-10-22OpenVAS check added
2026-09-18Record updated
2026-09-17Record updatedrecord updated
2026-09-16Publishedweakness classified, att&ck mapped, record updated

Affected products

checkpointcommercial · ILaka check point firewall-1, checkpoint firewall
- Quantum Security ManagementSecurity Products

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable

Weaknesses

CWE-121No name in the record

ATT&CK techniques

Mapped from the weaknesses above (CWE to ATT&CK), not observed in attacks.

Privilege EscalationT1068Exploitation for Privilege Escalationhigh confidence

Sources

References in the record

support.checkpoint.com/results/sk/sk1000155

In the news

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Checkpoint, not every advisory.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account