Check Point patches unauthenticated root code execution in Security Management and Log Server
CVE-2026-91843 lets an attacker with no credentials run code as root through the login process, and Check Point has published indicators of compromise while saying it has seen no exploitation in the wild.
The Watch · Security desk
What happened
- The vendor said it has no evidence of in-the-wild exploitation, and advised customers who do not have automatic updates enabled to patch their installations immediately.
- Tanium published five advisories, covering two high-severity SQL injection flaws in Tanium Asset and three lower-rated issues in Threat Response, one of which allows alerts to be created or modified.
- Kaspersky's September 17 advisory says Kaspersky Security 10 for Linux Mail Server is affected by a Redis vulnerability that was discovered in 2023.
Why it matters
- Who's exposed exposure Any Security Management or Log Server instance an attacker can route to is a root-level target with no credential step, so exposure here is decided by network placement.
- Who has to decide decision Publishing indicators of compromise alongside a no-exploitation statement leaves defenders two jobs: patching closes the login path, but it does not settle whether those indicators already appear in log history.
- What it limits constraint The Tanium Asset SQL injection needs an authenticated session. That holds the risk to insiders and stolen accounts, and puts those two bugs behind the Check Point fix in the patch order.
- What it sets up precedent Attackers have already been working Check Point product flaws, zero-days included, so a public pre-auth root bug in that line should be costed as a target for exploit development within days of the advisory.
Next story · Security · 10h ago
CISA adds Atlassian Data Center flaw CVE-2026-21589 to its exploited-vulnerabilities listConfirmed2 publishers
One of this week's three vendor bugs needs no account. Check Point says CVE-2026-91843 is reached through the login process, so the attacker meets it before authenticating [2]. The prerequisite is network reach to the interface. Check Point named Security Management and Log Server [1]; root on either puts an attacker inside the management tier.
Tanium's advisories rank lower. Two of its five cover high-severity SQL injection in Tanium Asset that authenticated attackers can use to read and write restricted data, or to tamper with the SQL queries the service executes [8]. Threat Response got a fix for SQL query tampering plus two medium-severity patches, one for a server-side request forgery that reaches restricted data and one for improper access control that allows alerts to be created or modified [9][10]. Added up, that is five vulnerabilities across five advisories, three of them SQL [13]. An account that can modify alerts inside a detection product can change what analysts see [10]. The published summaries state an authentication requirement for the two Asset bugs only.
Kaspersky's item is inherited. Its September 17 advisory says Kaspersky Security 10 for Linux Mail Server is affected by a Redis vulnerability discovered in 2023 [11]. Kaspersky said the flaw "could potentially cause product malfunction or allow an attacker to execute code when processing files of a certain format" [12]. The Check Point identifier is numbered in the 2026 series. That puts roughly three years between the discovery of the Redis bug and the advisory naming the affected Kaspersky product [14].
What to watch
- Any confirmed exploitation of CVE-2026-91843, or defenders reporting matches against Check Point's published indicators.
- Whether Tanium states authentication prerequisites for the three Threat Response issues as clearly as it did for the two in Asset.
- Whether Kaspersky names the 2023 Redis CVE, so operators can match it against inventory they already track.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence80
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence78
Perspective Coverage
4 publishers- Builder
- Builder 16%
- Operator
- Operator 75%
- Investor
- Investor 9%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Check Point informed customers about a critical vulnerability affecting its Security Management and Log Server products.
- [2]
CVE-2026-91843 can be exploited by an unauthenticated attacker, in Check Point's words, "to remotely execute arbitrary code with root privileges through the login process."
- [3]
For CVE-2026-91843 the vendor noted that there is no evidence of in-the-wild exploitation.
- [4]
Check Point advised customers who do not have automatic updates enabled to immediately patch their installations.
- [5]
Threat actors appear to have set their sights on vulnerabilities in Check Point products in recent months, including zero-days.
- [6]
Check Point has shared some potential indicators of compromise for CVE-2026-91843.
- [7]
Tanium published five new advisories this week covering high- and medium-severity vulnerabilities.
- [8]
In Tanium Asset, the company fixed two high-severity SQL injection vulnerabilities that authenticated attackers can exploit to gain read and write access to restricted data, or to tamper with SQL queries executed by the service.
- [9]
A vulnerability that can be leveraged for SQL query tampering was also fixed in Tanium Threat Response.
- [10]
Threat Response also received patches for two medium-severity vulnerabilities: a server-side request forgery allowing access to restricted data, and an improper access control issue that can be exploited to create or modify alerts.
- [11]
Kaspersky published an advisory on September 17 informing users that Kaspersky Security 10 for Linux Mail Server is affected by a Redis vulnerability discovered in 2023.
- [12]
"The vulnerability could potentially cause product malfunction or allow an attacker to execute code when processing files of a certain format," Kaspersky said.
- [13]
The Tanium advisories account for five distinct vulnerabilities, three of them SQL-related.
- [14]
About three years separate the 2023 discovery of the Redis vulnerability from the Kaspersky advisory naming the affected product, taking the 2026 CVE series of the Check Point flaw as the year of the patch week.
Sources
4 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comNew Check Point flaw lets hackers execute code with root privileges
1 article · September 18, 2026
- securityaffairs.comCheck Point Fixes Critical CVE-2026-91843 Allowing Root Code Execution
1 article · September 18, 2026
- securityweek.comCheck Point, Kaspersky, Tanium Patch Product Vulnerabilities
1 article · September 18, 2026
- thehackernews.comCritical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root
2 articles · September 18, 2026
Topics and entities
Topics
- Flaws in security products
- Network security appliances
- Vulnerability Management