Critical Check Point Flaw Grants Unauthenticated Root Access to Management Servers

A Pattern of Critical Management Flaws

The disclosure of CVE-2026-91843 marks a troubling trend for the network security giant. By industry counts, this is the fifth critical vulnerability since late July 2026 that allows an unauthenticated attacker to reach the Security Management Server. This sequence of high-severity disclosures has put Check Point customers on high alert.

The string of incidents began on July 22 with CVE-2026-16232, a SmartConsole authentication bypass that was actively exploited in the wild. In that instance, Check Point’s Lotem Finkelstein noted that the flaw primarily affected customers who had exposed their management servers directly to the internet without IP restrictions—the same configuration issue currently being highlighted with CVE-2026-91843. That earlier flaw was added to the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog almost immediately.

Since then, the company has disclosed several other significant issues:

• CVE-2026-62144: Another management bypass disclosed in July, though it was not reported as exploited.
• CVE-2026-18574: An August disclosure involving an authentication bypass that could lead to command execution on the management server.
• CVE-2026-85103: A September 9 disclosure regarding a heap overflow in VPN certificate decoding that could also impact Quantum Security Management.

Unlike some of the earlier flaws that were discovered following reports of active exploitation, Check Point states that CVE-2026-91843 was identified through internal research or confidential reporting, and no public proof-of-concept exploit currently exists. Nevertheless, the severity of the flaw and the history of similar vulnerabilities being targeted by sophisticated actors have led CISA and other national cyber defense agencies to monitor the situation closely.

Urgent Action Required

As of September 18, 2026, Check Point has updated its guidance to reflect the inclusion of R82.20 and Multi-Domain environments in the vulnerable list. The company continues to stress that the most effective defense is a combination of immediate patching and strict access control. Administrators are encouraged to review their "Trusted Clients" lists and ensure that no management server is reachable from the public internet.

The recurring nature of these vulnerabilities suggests a concerted effort by both vendors and researchers to audit the "pre-authentication" attack surface of critical security infrastructure. For now, the priority for Check Point administrators is clear: verify the application of the LivePatch and move management interfaces behind the safety of a trusted perimeter. Failure to do so could leave the "brain" of the corporate network open to an attacker capable of sending nothing more than a long username string.