Search your logs for "Username too long"

Most critical advisories tell you what to patch. This one also tells you how to find out whether someone already tried.

CVE-2026-91843 is a stack overflow in the unauthenticated login path of Check Point's Security Management and Log Servers, scored 9.8, giving remote code execution as root without credentials. It is triggered by a login request carrying an oversized username — and a failed attempt leaves a trace.

SmartConsole Audit and Admin login logs:

"Administrator failed to log in: Username too long"

Search for that string. Single hits matter, repeated hits matter more, and hits from unexpected or internet-facing source addresses matter most. The overflow is reachable before any credential check, so this line is what an attempt looks like whether or not it succeeded.

There is no confirmed exploitation. CISA records exploitation as none, the flaw is not in the Known Exploited Vulnerabilities catalogue, and Censys reported no public proof-of-concept as of 16 September. Check Point says it has received no reports of attacks.

That is the current state, not a forecast. A pre-authentication root vulnerability in network security management infrastructure does not usually stay theoretical for long once a working trigger circulates.

What is affected, and one correction worth making

The affected products are the Security Management Server, Multi-Domain Security Management Server, Log Server and Multi-Domain Log Server. Standalone deployments, which run management and gateway on one system, are also vulnerable.

R82.20 all versions R82.10 Jumbo Hotfix Take 44 or below R82 Jumbo Hotfix Take 126 or below R81.20 Jumbo Hotfix Take 166 or below R81.10 Jumbo Hotfix Take 190 or below (end of support) R81, R80.40, R80.30, R80.20, R80.10, R80 (end of support)

Some coverage has listed R82 as affected at "Take 22 or below". The figure is 126. If you checked your R82 servers against the lower number and concluded you were safe, check again.

Smart-1 Cloud, Check Point's hosted management service, is not affected — the fix was deployed there before public disclosure.

The fix is not a Jumbo Hotfix

This is the part most likely to produce a false sense of coverage.

Check Point ships this through its urgent LivePatch channel, not as a normal Jumbo Hotfix Take. Being current on Jumbo Takes is not protection. The offline packages are urgent security update Take 29 for R82.20 and Take 28 for R82.10, R82 and R81.20.

If automatic updates are enabled — the setting in SmartConsole under Global Properties, Data Access Control — Check Point says you are already protected.

Confirm that rather than assume it.

There is a reason to insist. When Check Point pushed fixes for two VPN certificate flaws the previous week, several customers in its own community reported that the automatic package had not reached their systems on the day of the announcement, and a community administrator replied that it was presumably rolling out in stages. Customers also found that download links appeared only after signing in to the User Center.

The verification takes one command. In Expert mode, on every management and log server:

cplp list

Expect a line showing fwm:fwm as armed, in livepatch mode, with a comment referencing CVE-2026-91843. If it is not there, the server is not protected regardless of what the update setting says.

End-of-support branches: sources disagree

Censys states that R81.10, R81 and the R80.x branches receive no fix at all, and that upgrading to a supported branch is the only remediation.

Check Point told The Hacker News something different — that a fix for out-of-support versions is available, and that customers who need it should raise a support ticket.

If you are on one of those branches, open the ticket. Do not assume either account is the operative one, and do not wait for the situation to clarify itself while an unpatched management server is reachable.

The mitigation, and why it sounds familiar

Check Point's guidance is to restrict SmartConsole Trusted Clients to specific approved IP addresses or subnets, under Manage & Settings, Permissions & Administrators, Trusted Clients. Client Type must not be set to "Any". Management access should not be reachable directly from the internet.

According to Check Point, the vulnerable path runs only through the Trusted Clients setting — which makes this a mitigation with real effect, not a generic hardening suggestion.

It is also, word for word, the first mitigation Check Point recommended in July.

Five in two months

By The Hacker News' count of Check Point's own CVE records, this is the fifth critical flaw since 22 July that an attacker could reach on the Security Management Server without logging in.

The first of those was actually exploited. Check Point wrote at the time that it affected a handful of customers in one configuration — when management was exposed directly to the internet without IP restrictions.

Five separate opportunities in two months to learn that the exposure, not the individual bug, is the thing under your control.

We made the same point a week ago writing about the Cisco firewall management appliance, where a ransomware affiliate got in through a flaw scored 5.3 because it sat on the security management plane. The lesson repeats because the asset class is the same: the console that manages your firewalls knows your topology, holds credentials to the devices it manages, and is integrated with your directory. Anything scored on that plane deserves treatment a band above its number.

What to do

1. Search the audit logs for "Administrator failed to log in: Username too long", across the whole retention window. This is free and it is the only way to know whether you were probed.
2. Apply the urgent LivePatch to every Security Management Server, Multi-Domain server and Log Server. Not just the primaries.
3. Verify with cplp list on each one. Armed, livepatch, CVE referenced.
4. Check Trusted Clients on every management server. Specific addresses, never "Any". This is the mitigation with real effect and it is also the fix for the next one.
5. Confirm management is not reachable from the internet. Censys observes 3,836 hosts worldwide presenting the default identity Check Point assigns to these servers — a count of role presence, not of vulnerable systems, but each one is a management plane answering to the open internet.
6. If you are on an end-of-support branch, raise a support ticket today and plan the upgrade regardless.

4Tify reviews exposure and configuration on security management infrastructure — the consoles that hold the keys to everything else. If you run Check Point management and cannot confirm your Trusted Clients settings, get in touch.