{"id":11949,"date":"2026-09-18T08:39:18","date_gmt":"2026-09-18T14:39:18","guid":{"rendered":"https:\/\/beaconlab.us\/publicacion\/alert-2026-103-critical-rce-vulnerability-as-root-in-check-point-security-management-and-log-servers\/"},"modified":"2026-09-29T09:59:06","modified_gmt":"2026-09-29T15:59:06","slug":"alert-2026-103-critical-rce-vulnerability-as-root-in-check-point-security-management-and-log-servers","status":"publish","type":"publicacion","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-103-critical-rce-vulnerability-as-root-in-check-point-security-management-and-log-servers\/","title":{"rendered":"Alert 2026-103 Critical RCE Vulnerability as root in Check Point Security Management and Log Servers"},"content":{"rendered":"\n

Affected product(s):<\/h2>\n\n
Product \/ component<\/strong><\/td>Status<\/strong><\/td><\/tr>
Check Point Security Management Server<\/strong><\/td>Affected<\/td><\/tr>
Check Point Multi-Domain Security Management Server<\/strong><\/td>Affected<\/td><\/tr>
Check Point Log Server<\/strong><\/td>Affected<\/td><\/tr>
Check Point Multi-Domain Log Server<\/strong><\/td>Affected<\/td><\/tr>
Standalone Deployments (Management + Gateway on the same machine)<\/strong><\/td>Affected<\/td><\/tr>
Smart-1 Cloud<\/strong><\/td>Not affected; the fix has already been deployed by Check Point<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

A server is considered vulnerable if it runs any of the following branches with the indicated Jumbo Hotfix Take<\/strong> or an earlier version:<\/p>\n\n

Branch<\/strong><\/td>Affected range<\/strong><\/td>Recommended fix<\/strong><\/td><\/tr>
R82.20<\/strong><\/td>All builds<\/td>Install the LivePatch<\/em> \/ urgent update available for R82.20<\/td><\/tr>
R82.10<\/strong><\/td>Jumbo Hotfix Take 44 or earlier<\/td>Install the LivePatch<\/em> or update to a later fixed Take<\/td><\/tr>
R82<\/strong><\/td>Jumbo Hotfix Take 126 or earlier<\/td>Install the LivePatch<\/em> or update to a later fixed Take<\/td><\/tr>
R81.20<\/strong><\/td>Jumbo Hotfix Take 166 or earlier<\/td>Install the LivePatch<\/em> or update to a later fixed Take<\/td><\/tr>
R81.10<\/strong><\/td>Jumbo Hotfix Take 190 or earlier<\/td>EoS branch; request fix from Check Point Support or plan priority migration<\/td><\/tr>
R81, R80.40, R80.30, R80.20, R80.10 and R80<\/strong><\/td>All versions<\/td>EoS branches; request assistance from Check Point Support and migrate to a supported release<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

Description<\/h2>\n\n

A vulnerability has been published in Check Point, labeled as CVE\u20112026\u201191843<\/strong>, a critical stack-based buffer overflow<\/em> vulnerability in the login process of its management and log servers. The flaw has a CVSS 9.8<\/strong> score and could allow an unauthenticated remote attacker to execute arbitrary code with root<\/strong> privileges.<\/p>\n\n

CVE\u20112026\u201191843<\/strong> is a stack-based buffer overflow vulnerability, classified as CWE\u2011121<\/strong>, in the login process of Security Management Server and Log Server. The vulnerable condition occurs before authentication<\/strong>: a remote attacker can send a login request with an excessively long username and trigger the overflow.<\/p>\n\n

The vulnerable path is associated with the Trusted Clients<\/strong> mechanism, which defines which machines can connect to the management server via SmartConsole. According to Check Point, the vulnerability is reachable only through this trusted clients configuration. A permissive configuration, especially if it uses the \u201cAny\u201d<\/strong> value or allows access from the Internet, significantly increases the attack surface.<\/p>\n\n

A successful compromise of a Management Server is especially serious because this component controls security policies, gateway configuration, network objects, credentials, and administrative access for the Check Point ecosystem. Execution as root could allow modifying firewall policies, introducing unauthorized access rules, altering logs, extracting configurations, and using the server as a pivot point toward gateways and other managed assets.<\/p>\n\n

The vendor recommends immediately applying the fix via Check Point LivePatch<\/strong> or the corresponding offline update package. At the time of publication, Check Point indicated that it had no evidence of active exploitation and CISA recorded the exploitation status as \u201cnone\u201d; however, because this is a pre-authentication, remote flaw with root execution on management infrastructure, remediation should be considered the highest priority.<\/p>\n\n

Solution<\/h2>\n\n

The main solution is to apply the LivePatch<\/em> indicated in advisory sk1000155<\/strong>. Machines with automatic updates enabled per Check Point configuration may receive the fix automatically, but administrators should verify its installation using cplp list.<\/em><\/p>\n\n

https:\/\/support.checkpoint.com\/results\/sk\/sk1000155<\/a><\/p>\n\n

For environments without LivePatch or automatic updates, Check Point provides urgent offline update packages. Take 29<\/strong> packages are reported for R82.20 and Take 28<\/strong> for R82.10, R82, and R81.20; confirm the exact applicable package from the support portal and the advisory before deploying it.<\/p>\n\n

There is no mitigation that replaces applying the patch. Restricting Trusted Clients, removing \u201cAny\u201d, and closing direct Internet access are important compensating controls, but the LivePatch<\/em> must be installed as a priority.<\/p>\n\n

Additional information:<\/h2>\n\n