Check Point has released an emergency patch for a critical flaw in its Security Management and Log Servers, urging immediate action from all affected organisations. The vulnerability, tracked as CVE-2026-91843 and carrying a CVSS score of 9.8, allows an unauthenticated remote attacker to gain root-level access to core security management infrastructure.
The flaw bypasses all authentication requirements. An attacker with network access to a management interface can execute arbitrary code and seize complete control—enabling reconfiguration of firewall policies, disabling of logging, manipulation of audit trails, and unrestricted lateral movement across the network.
The deepest irony is that the systems designed to guard the network become the primary attack vector. Compromising a management server hands an attacker the master key to an organisation's entire security architecture.
For Managed Security Service Providers (MSSPs), this flaw presents a multi-tenant catastrophe. A single compromised management console could provide a pathway into all managed client environments, triggering a cascading breach across numerous customer networks. Organisations relying on MSSP partnerships should immediately verify whether their provider has applied the patch.
All organisations using affected Check Point software must apply the vendor-supplied patch immediately. Secondary actions are equally critical: network segmentation should be reviewed to ensure management interfaces remain strictly isolated on trusted internal networks. Security teams must also audit access logs for suspicious pre-patch activity that may indicate prior compromise.
While Check Point has not confirmed active exploitation in the wild, the trivial attack method and catastrophic potential make proactive remediation essential. Organisations using Check Point infrastructure should treat this as an emergency—not a routine update.
Check Point 已針對其安全管理伺服器及日誌伺服器中一個嚴重漏洞發布緊急補丁，敦促所有受影響的機構立即採取行動。該漏洞追蹤編號為 CVE-2026-91843，CVSS 評分為 9.8，允許未經認證的遠端攻擊者獲取核心安全管理基礎設施的 root 權限。
此漏洞繞過了所有認證要求。攻擊者僅需具備通往管理介面的網絡存取權限，便可執行任意代碼並完全控制系統——從而能夠重新配置防火牆策略、停用日誌記錄、篡改審計軌跡，以及在整個網絡中不受限制地橫向移動。
最深層的諷刺在於，旨在守護網絡的系統反而成為主要攻擊途徑。一旦管理伺服器遭入侵，攻擊者即獲得通往機構整個安全架構的萬能鑰匙。
對於託管安全服務供應商（MSSPs）而言，此漏洞帶來多租戶災難。單一被入侵的管理控制台可能成為滲透所有託管客戶環境的路徑，引發跨眾多客戶網絡的連鎖式資料外洩事件。依賴 MSSP 合作夥伴的機構應立即確認其供應商是否已應用補丁。
所有使用受影響 Check Point 軟件的機構必須立即安裝供應商提供的補丁。後續措施同樣關鍵：應檢視網絡分段策略，確保管理介面嚴格隔離於可信內部網絡中。安全團隊還必須審查存取日誌，尋找可能表明先前已被入侵的補丁安裝前可疑活動。
儘管 Check Point 尚未確認實際野外利用案例，但考慮到攻擊方法極為簡單且後果災難性，主動修復至關重要。使用 Check Point 基礎設施的機構應將此事視為緊急情況——而非例行更新。