CVE-2026-123039: Check Point Gaia OS Root Escalation Exploited in Gateway Attacks, Added to CISA KEV

CISA added CVE-2026-123039, a root privilege escalation in Check Point's Gaia OS, to the Known Exploited Vulnerabilities (KEV) catalog on Friday, November 13, 2026, with a due date of Monday, November 16. Check Point says it observed an active exploit against a couple of dozen customers. The flaw is local-only and scores 7.8 High, but reports of the attacks describe it as the step after a webshell lands on the gateway. Fixes ship in Jumbo Hotfix Accumulators for R81.20, R82, R82.10 and R82.20.

What the flaw does

Check Point's advisory, sk1000362, says the Gaia OS process dynamic_server runs as root and listens on /tmp/dynamic_socket. The socket is created world-writable (0777), the process does not authenticate whoever connects, and it executes whatever command string it receives as root. Any local user can therefore send a command and have it run as root. The advisory states the attacker must already have local code execution on the appliance. The CVE record scores it 7.8 High (CVSS 3.1, AV:L/AC:L/PR:L/UI:N, high impact on confidentiality, integrity and availability) and lists CWE-862, missing authorization, and CWE-732, incorrect permission assignment.

The fix makes the process block and log unauthenticated calls, and the socket becomes 0660 owned by root and the config group. The daemon logs commands to /var/log/dynamicCli.log, which is where Check Point points defenders to look.

On exploitation, the advisory reads that Check Point observed an active exploit of this vulnerability against a couple of dozen customers. It gives no date, actor or indicator hashes, and no source we read credits a reporter. The advisory was created on November 8 and last modified on November 12, and the CVE record was published on November 12.

Who is affected

The sources disagree on scope. Check Point's advisory lists Force firewalls, Management and Log Servers, Multi-Domain Security Management and Log Servers, and Maestro Orchestrator, across R81 through R82.20. The CVE record names only Quantum Security Gateway and Quantum Security Management, with the four hotfix thresholds above and no R81 or R81.10. Spark Firewalls and Smart-1 Cloud are not affected.

The thresholds also leave gaps. The record says affected "or below" a take, and the advisory says fixed "starting from" a higher one, so Take 51 on R82.10, Takes 11 to 13 on R82.20 and Take 131 on R82 are not addressed by either. Treat any take below the fixed one as vulnerable. The advisory does not say whether a standalone hotfix exists.

A local flaw in the middle of an attack chain

The 7.8 reflects a local attacker with low privileges. SSVC, though, reads Active and Total impact, and the due date is three days after listing. The attack reports explain why it deserves more than its score. In how SecurityWeek and Cyber Security News describe Check Point's findings, this flaw is never the entry point:

1. Initial access comes through PHP2Shell, the pair of PHP use-after-free flaws CVE-2026-109618 and CVE-2026-109619 that were patched on October 21, 2026, against Check Point Mobile Access portals.
2. The attackers place PHP webshells in a directory the portal uses for its login pages.
3. They use CVE-2026-123039 to go from the portal's service account to root.
4. They install the TSGA and TSProxy backdoors, which Check Point says share code and keys with the PhiliKit toolkit.
5. In the first wave, they scan the internal network and reach an ESXi host over SSH, where a wiper runs.

The first wave began on October 30 against Israeli organizations, with destructive activity against some of them. A second wave on November 2 hit organizations in several countries, and no destruction was seen. Check Point says the evidence does not allow a high-confidence view of who is behind it. The advisory for this flaw was created on November 8, nine days after the campaign began, though no source says when the root step was first used.

The practical point is that a local-only flaw becomes remote the moment another bug gives the attacker a shell. Rank it by the chain, not the vector.

Reading it on VulnTracker

A few things to read with care. The affected list follows the CVE record, so it shows two products and no R81 or R81.10, while Check Point's advisory is broader. The fixed takes in this post come from the advisory, since the guide field is empty. The page carries 3 Newsroom items and 1 exploit entry, which we did not review. EPSS is low, and the KEV flag together with the vendor's own statement of exploitation against customers tells you more.

What to do

1. Install the Jumbo Hotfix Accumulator at or above the fixed take for your release: R82.20 Take 14, R82.10 Take 52, R82 Take 132 or R81.20 Take 174. Afterwards, confirm the socket is 0660 owned by root and the config group, and that /var/log/dynamicCli.log records rejected connections from unauthorized uids.
2. For R81 and R81.10, which are end of support with no fix listed, plan an upgrade to a supported release.
3. If you cannot patch yet, Check Point's advisory gives dbset commands to stop and disable the dynamic_server process and to revert it. Stopping it makes the Dynamic CLI commands listed in sk144112 fail. To check whether it is running, use ps auxw | grep -v grep | grep 'dynamic_server' in Expert mode.
4. Hunt before and after patching. Check Point says suspicious lines in /var/log/dynamicCli.log include Received = #return_value#, and commands such as id;, whoami, /etc/shadow, ncat, /dev/tcp, curl, wget, base64, useradd and authorized_keys. From Cyber Security News' summary of Check Point Research, also look for PHP webshells in the Mobile Access portal template directory, a process named slot_CPconfigdaemon, the file /lib/libcpfwcommon.so, and unexpected SSH logins to ESXi hosts with the vpxuser account.
5. Patching does not remove an attacker who already has root. If the hunt finds anything, treat the appliance as compromised.
6. The reported entry point was PHP2Shell. The sources we read do not say which Check Point builds address CVE-2026-109618 and CVE-2026-109619, so confirm that with Check Point for your Mobile Access portal.
7. Federal civilian agencies follow the required action in the KEV entry, due November 16. Everyone else can adopt the same date.

Takeaway

The fix is a Jumbo Hotfix away and the deadline is Monday, so the work is applying it and checking the log. The score undersells the flaw because it is rated alone, while the attackers used it as the second step after a webshell. What is still unknown is how many gateways were reached before the hotfix, who is behind the campaign, and when the root step was first used. To follow this CVE and the next KEV addition, add Check Point to your Track List on VulnTracker.

References

• Check Point advisory sk1000362
• SecurityWeek, PHP2Shell Exploited in Destructive Check Point Gateway Attacks
• Cyber Security News, CISA Warns of Check Point 0-Day Vulnerability Exploited to Gain Root Access
• Cyber Security News, Check Point 0-day Exploited in PHP2Shell Attack to Deploy Malware and Wipe ESXi Files
• OffSec, PHP2Shell: Critical Vulnerabilities in PHP Core
• CVE.org record for CVE-2026-123039
• NVD entry for CVE-2026-123039
• CISA KEV entry for CVE-2026-123039