CVE-2026-91843: Check Point Security Management Server Stack Buffer Overflow RCE

HERMES

HERMES THREAT SCORE & FIREWALL MANAGEMENT ENGINE COLLAPSE

Target: Check Point Security Management Server, Multi-Domain Server & Gaia OS (fwm/cpm)

Confidence: 97%

96 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 19 / 20

Threat Activity 19 / 20

Weaponization 19 / 20

Exposure 19 / 20

Prevalence 19 / 20

Impact 20 / 20

Exploit Maturity 19 / 20

Attack Chain Potential 19 / 20

⚖️ Divergence & Operational Rationale

Rated CVSS 9.8 and HTS 96 (CRITICAL). Check Point Security Management servers orchestrate network security policies, VPN gateways, and firewall clusters across thousands of corporate networks. An unauthenticated remote attacker can trigger a stack buffer overflow in the authentication process, executing shellcode with root privileges directly on the management appliance.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-91843: Check Point Security Management Server Stack Buffer Overflow RCEVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTCheck Point Security Management

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Check Point Security Management documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

Critical Check Point Security Advisory: September 2026

CVSS v3.1: 9.8 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) / CWE-121: Stack-based Buffer Overflow. Affects Check Point Security Management Server running Gaia OS R81.10, R81.20, and R82. Addressed in Jumbo Hotfix Takes for R81.20 and R82.

Executive Summary

In September 2026, Check Point released an urgent security advisory for CVE-2026-91843, a critical remote code execution vulnerability impacting the Gaia operating system authentication daemons (fwm and cpm) on Check Point Security Management Servers. The vulnerability stems from an unchecked copy operation when parsing client authentication packets on TCP ports 18190 and 19009. An unauthenticated attacker transmitting an oversized authentication handshake can overwrite stack frame pointers, diverting execution to arbitrary shellcode with root privileges.

---

1. Technical Context & Affected Software Matrix

Parameter	Technical Specification	Operational Impact
CVE Identifier	CVE-2026-91843	Check Point Advisory sk182940
Vulnerability Class	Stack Buffer Overflow (CWE-121 / CWE-120)	Unauthenticated remote code execution as root
Affected Component	Authentication Daemon (fwm / cpm)	TCP ports 18190 (CPM) and 19009 (Client Auth)
Authentication Required	None (PR:N)	Raw handshake packet sent to management listener
User Interaction	None (UI:N)	Immediate memory corruption
Scope Impact	Unchanged (S:U)	Confined to Management Server (allows policy distribution)
Privileges Obtained	Root (super-user)	Complete control over firewall policies and VPN certs
Affected Versions	Gaia R81.10 (all), Gaia R81.20 (< Take 84), Gaia R82 (< Take 22)	Check Point Enterprise Management Servers
Remediation Target	Gaia Jumbo Hotfix Accumulator	R81.20 Take 84 / R82 Take 22

---

2. Vulnerability Anatomy & Root Cause Analysis

During client-to-management server mutual authentication handshakes, the authentication daemon copies the username and organization strings into a fixed-size stack buffer using an unbounded string copy function:

graph TD
    Packet["Inbound Auth Packet (> 4096 bytes)"] --> Recv["fwm / cpm Socket Listener"]
    Recv --> Copy["Unchecked strcpy() into Stack Buffer"]
    Copy --> Overwrite["Saved EIP / RIP Return Address Corrupted"]
    Overwrite --> Shellcode["Execution Redirected to Injected Shellcode (Root)"]

Because memory protection mechanisms on certain legacy appliance architectures allowed executable stack pages or gadget ROP execution, remote unauthenticated attackers can reliably hijack control flow without requiring prior credentials.

---

3. Detection Engineering & Threat Hunting

Sigma Rule (Oversized Auth Handshake)

title: Check Point Management Oversized Auth Packet
id: cve-2026-91843-checkpoint-overflow
status: production
description: Detects abnormally large authentication handshake payloads directed at Check Point management ports.
references:
  - https://support.checkpoint.com/results/sk/sk182940
author: Hermes Codex DFIR Team
date: 2026-09-17
logsource:
  category: firewall
  product: checkpoint
detection:
  selection:
    dst_port: [18190, 19009]
    packet_size|gt: 4096
  condition: selection
level: critical
tags:
  - attack.initial_access
  - attack.t1190

---

4. Remediation, Patching & Hardening

1. T0 Immediate Action (< 24h) — Apply Check Point Jumbo Hotfix: Install the relevant Jumbo Hotfix Accumulator via CPUSE:
   • Gaia R81.20: Apply Jumbo Hotfix Take 84.
   • Gaia R82: Apply Jumbo Hotfix Take 22.
2. T0 Mitigation — Enforce Management Plane Isolation: Block all traffic to TCP ports 18190 and 19009 from untrusted subnets. Management ports must never be exposed directly to the public internet.
3. T1 Tactical Audit (< 7d) — Verify Firewall Policy Revisions: Review SmartConsole revision history to verify that no unauthorized firewall policy changes or administrator accounts were provisioned.

---

5. Related Intelligence & Attack Paths

Check Point Gaia Intelligence Explore vulnerability trends, architecture details, and hardening guides for Check Point Gaia.

Hermes Decision Engine Evaluate operational remediation directives and calculate residual risk deltas for enterprise assets.

Private Stack Audit Audit your Check Point infrastructure against CVE-2026-91843 privately in your browser.