The United States cybersecurity agency, CISA, added the CVE-2026-123039 flaw to its Known Exploited Vulnerabilities (KEV) catalog on Friday, November 13, 2026. The flaw affects Check Point's Gaia OS operating system and has already been used in real attacks against the company's firewalls. U.S. federal agencies have until Monday, November 16, to apply the fix.
What CVE-2026-123039 is
The flaw is a local privilege escalation in the Gaia OS DynamicCLI service, scored CVSS 7.8 (High). The dynamic_server process runs as root and listens on the local socket /tmp/dynamic_socket, created with 0777 permissions — meaning any local user can write to it. The process does not authenticate whoever connects and runs as root any command it receives. In practice, an attacker who already has limited access to the gateway can become root. The flaw on its own is not remotely exploitable: code execution on the device is required first. The weaknesses are classified as CWE-862 (missing authorization) and CWE-732 (incorrect permission assignment).
The attack chain started with PHP2Shell
In the attacks investigated by Check Point Research, initial access came from PHP2Shell, the pair of critical PHP flaws (CVE-2026-109618 and CVE-2026-109619) patched on October 21 and covered by Geekiki at the time. The attackers exploited internet-facing Mobile Access portals and then used CVE-2026-123039 to escalate to root. The first wave began on October 30 against organizations in Israel, with destructive activity in some cases; a second wave, starting November 2, hit organizations in several countries. Exploitation was observed between October 30 and November 4.
After gaining root, the attackers installed webshells matching the pattern zz*.tpl and the TSGA backdoor, disguised as the CPconfigdaemon component, along with the TSProxy proxy, and moved over SSH to VMware ESXi servers — in some cases using wiper malware.
Attribution remains unconfirmed
Check Point links the TSGA backdoor to the PhiliKit toolkit, previously tied to the China-nexus group UNC5221, but says the evidence does not support attributing the operation with confidence. The company observed active exploitation of the flaw at about two dozen customers.
Who needs to patch, and by when
CISA set a deadline of November 16, 2026, for U.S. federal agencies to apply the fix — the deadline formally applies to them, but it signals urgency for any organization running the equipment. The flaw affects Check Point gateways and management servers running Gaia OS versions R81 through R82.20, including Force firewalls, management and log servers, Multi-Domain systems and the Maestro Orchestrator. Spark firewalls and Smart-1 Cloud are not affected.
Fixes ship in the November Jumbo Hotfix Accumulator packages: R82.20 Take 14, R82.10 Take 52, R82 Take 132 and R81.20 Take 174, or later. Versions R81 and R81.10 are end of support and have no listed fix. As a temporary mitigation, advisory sk1000362 describes how to stop the dynamic_server process and prevent it from restarting — at the cost of disabling Dynamic CLI commands. Anyone who kept gateways exposed and unpatched since October 30 should check the /var/log/dynamicCli.log log for unexpected commands.
Sources
- Check Point CheckMates — Security Advisory: Three Vulnerabilities Fixed (official notice)
- Cyber Security News — CISA Warns of Check Point 0-Day Vulnerability Exploited to Gain Root Access
- GBHackers — CISA Warns of Actively Exploited Check Point Zero-Day Vulnerability Allowing Attackers to Gain Root Access
- VulnTracker — CVE-2026-123039: Check Point Gaia Root Flaw on CISA KEV
- HOL — Check Point CVE-2026-123039 on CISA KEV: how to fix and check
- Geekiki — PHP2Shell: AI uncovers critical RCE flaws in PHP affecting 70% of sites
Image: seal of the Cybersecurity and Infrastructure Security Agency (CISA), the United States agency that maintains the Known Exploited Vulnerabilities (KEV) catalog. Public-domain seal via Wikimedia Commons.
Transparency: this article was produced with the assistance of artificial intelligence, cross-checked against public posts on X and sources on the internet. We recommend consulting the original sources cited to confirm the facts.
By Muse
