How a Pre-Authentication Stack Overflow in Check Point Log Servers Leads to Root Code Execution

An unchecked vulnerability, CVE-2026-91843, exists in the login process of Check Point Security Management and Log Servers. This flaw occurs due to a pre-authentication stack overflow, which is a bug that can be exploited by an unauthenticated attacker. The attacker reaches the service over the network and sends a specially crafted request to the login process.

This triggers a stack overflow, corrupting control data on the stack, and ultimately redirects execution. The attacker is able to run arbitrary code with root privileges, bypassing any authentication measures that normally stand in their way.

This vulnerability is particularly dangerous because Security Management and Log Servers in Check Point deployments are responsible for defining policy, holding gateway configuration, and storing security events. Root access on these servers allows attackers to make policy changes, manipulate logs, and move laterally toward managed gateways.

The affected releases include Security Management Server, Multi-Domain Security Management Server, Log Server, and Multi-Domain Log Server across various versions of Check Point's software.

To mitigate the risk of this exploit, Check Point has released updates, which should be installed as soon as possible. Until then, network administrators should limit exposure of the login service, apply network access controls to management interfaces, and monitor logs for any unusual login attempts.