Posted on

Check Point CVE-2026-91843 – Unauthenticated Root RCE in Management and Log Servers

Threat Overview

Check Point disclosed CVE-2026-91843 on September 16, with major reporting updated September 18. The CVSS 9.8 stack-based buffer overflow occurs in the login process before authentication. A low-complexity network attacker can send an overlong username through the Trusted Clients path and potentially execute arbitrary code as root. Check Point states there is currently no indication of exploitation in the wild. The vendor published a concrete detection message: Administrator failed to log in: Username too long.

References

Impacted Systems

Check Point Security Management Server, Log Server, Multi-Domain Server, and standalone deployments. Affected: R82.20 all builds; R82.10 Jumbo Hotfix Take 44 or below; R82 Take 126 or below; R81.20 Take 166 or below; R81.10 Take 190 or below. Older R81/R80 branches are end of support. Smart-1 Cloud is reported unaffected because the fix is already applied. Direct Internet management exposure and Trusted Clients configured broadly increase risk. LivePatch is available.

Why this matters

Management servers control firewall policy and administrative trust. Root RCE on this plane can enable policy manipulation, credential access, log tampering, and lateral movement.

Exploitation Status

Check Point states there is no indication of in-the-wild exploitation as of September 18. CISA had not added it to KEV. No public PoC was reported as of September 16.

What this hunt looks for

The hunt prioritizes the vendor-published overlong-username message, failed administrator logins, new sources reaching management services, root or shell behavior, administrative changes, and unexpected outbound connections.

Required logs

Check Point management and audit logs, CommonSecurityLog, and supporting Syslog ingested into Microsoft Sentinel. Gateway telemetry alone may not include management-server application events.

First Pass – Published Username Too Long Indicator

CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where Message has "Administrator failed to log in: Username too long"
| project TimeGenerated,SourceIP,DestinationIP,DestinationPort,DeviceName,DeviceAction,Message
| order by TimeGenerated desc

Check Point Failed Administrator Logins

CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where Message has_all ("Administrator","failed","log")
| summarize Attempts=count(),FirstSeen=min(TimeGenerated),LastSeen=max(TimeGenerated),Targets=dcount(DestinationIP),TargetIPs=make_set(DestinationIP,50) by SourceIP
| order by Attempts desc

New Sources Reaching Management Services

let Known=CommonSecurityLog
| where TimeGenerated between (ago(30d)..ago(2d))
| where DestinationPort in (22,443,19009)
| summarize by SourceIP,DestinationIP,DestinationPort;
CommonSecurityLog
| where TimeGenerated >= ago(2d)
| where DestinationPort in (22,443,19009)
| join kind=leftanti Known on SourceIP,DestinationIP,DestinationPort
| project TimeGenerated,SourceIP,DestinationIP,DestinationPort,Protocol,DeviceAction,Message
| order by TimeGenerated desc

Management Server Root or Shell Activity

Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any ("uid=0","root","/bin/bash","/bin/sh","curl ","wget ","chmod +x")
| project TimeGenerated,Computer,HostName,ProcessName,SeverityLevel,SyslogMessage
| order by TimeGenerated desc

Check Point Administrative Changes

CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where Message has_any ("administrator","admin","permission","Trusted Clients","policy")
| where Message has_any ("created","added","changed","modified","deleted","installed")
| project TimeGenerated,SourceIP,DestinationIP,DeviceName,DeviceAction,Message
| order by TimeGenerated desc

New Outbound Destinations From Management Systems

let Baseline=CommonSecurityLog
| where TimeGenerated between (ago(30d)..ago(2d))
| summarize by SourceIP,DestinationIP,DestinationPort;
CommonSecurityLog
| where TimeGenerated >= ago(2d)
| join kind=leftanti Baseline on SourceIP,DestinationIP,DestinationPort
| project TimeGenerated,SourceIP,DestinationIP,DestinationPort,Protocol,DeviceAction,Message
| order by TimeGenerated desc

Check Point Login Failure Spikes

CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where Message has_any ("failed to log in","login failed","authentication failed")
| summarize Failures=count() by bin(TimeGenerated,15m),DestinationIP,SourceIP
| where Failures >= 10
| order by TimeGenerated desc

Detection Notes

The exact Username too long message is the highest-confidence vendor pivot. No exploitation is confirmed, so post-exploitation hunts are precautionary and behavioral. Check Point management logs may be absent from Sentinel even when gateway logs are present. Confirming LivePatch state requires appliance-side validation.

Leave a comment