[Important Notification] Action required - Critical Security Update (CVE-2026-91843) - Sep 16th 202

[_Val_]

Please be advised regarding a critical vulnerability, CVE-2026-91843 (CVSS Score 9.8), affecting Check Point Security Management and Log Servers. 

This vulnerability may allow an unauthenticated attacker to remotely execute arbitrary code with root privileges through the login process.

At this time, there is no indication that this vulnerability has been exploited in the wild. However, due to its critical severity and potential impact, we strongly recommend taking immediate action to protect your environment.

Required actions

• Apply the LivePatch fix as described in sk1000155 - customers with automatic updates enabled are already protected.
• As a mitigation, follow the instructions in the Check Point Management and Gateway hardening best practices guide, and limit management Trusted Clients access to known, specific internal IP addresses.

If you have any questions or need assistance assessing your environment, please contact Check Point Support or reach out to your Check Point representative – we are here to help.

Thank you for your prompt attention to this matter.

[PecenkA]

Windows Security flags urgent_security_updates_R82_Bundle_T28_AutoUpdate.tar as Trojan:Script/Wacatac.H!ml

[RemoteUser]

S1C Users are impacted?

[PhoneBoy]

As stated in sk1000155: The Smart-1 Cloud environment is not affected because the fix has already been implemented there.

[WiliRGasparetto]

por isos a importância de usar o Check Point Live Patch falo sobre isso no post: https://community.checkpoint.com/t5/Firewall-Security-Management/Check-Point-Live-Patch-Why-sk185114...

[WiliRGasparetto]

To illustrate the importance of deploying the CPLP: an engineer from our team went to check on a client regarding today's CVE, and it had already been automatically remediated here is the screenshot showing zero impact on the environment.

[DominusRex23]

Hi, are standalone deployments affected as well?

[StackCap43382]

The impacted process is the FWM process which is used for authentication.

A stand-alone Manager-GW deployment still has the FWM process so IS at risk and needs Patch 28 of CPLP.