Threat feed

HighCVSS7.8#CVE-2026-123039 #Check Point #Gaia #privilege escalation #firewall #KEV #PHP2Shell #Mobile Access

CVE-2026-123039 — Check Point Gaia OS local privilege escalation to root, exploited in the wild: explainer and fix (listed in KEV, due 16 November)

CVE-2026-123039: a Check Point Gaia DynamicCLI flaw that lets a local user become root (CVSS 7.8). Exploited, in KEV since 13 November. Fixed in a Jumbo Hotfix.

Published 2026-11-14 Updated 2026-11-14 Last verified 2026-11-14 11 min read

On this page

An explainer on a Check Point Gaia OS vulnerability (CVE-2026-123039) that lets a local user on the appliance become root. It covers what happens, who is affected and how to respond, from a defender's point of view and without attack steps.

Advisory summary — ADVISORY / KEV

CVE: CVE-2026-123039 (privilege escalation in the Gaia OS DynamicCLI daemon)
Severity: CVSS v3.1 7.8 (High; vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; assigned by Check Point)
Type: Missing authorization (CWE-862), incorrect permission assignment for a critical resource (CWE-732); local privilege escalation
Impact: An authenticated local user can run arbitrary commands as root
Affected: Force Firewalls, Management and Log Servers, Multi-Domain Security Management and Log Server, Maestro Orchestrator (R82.20, R82.10, R82, R81.20, R81.10, R81). Spark Firewalls and Smart-1 Cloud are not affected
Fix: Jumbo Hotfix Accumulator: R82.20 Take 14 / R82.10 Take 52 / R82 Take 132 / R81.20 Take 174 (or later). No fix for R81.10 and R81 (EOS)
Published: Advisory created 8 November 2026 (last modified 12 November). CVE published 12 November
Exploitation: Check Point confirmed exploitation against a couple of dozen customers. Added to CISA KEV on 13 November 2026 (due 16 November)

7.8

CVSS v3.1 (Check Point)

A couple of dozen

Exploitation confirmed by Check Point

root

Privilege gained

16 Nov

KEV due date

Install the Jumbo Hotfix; until you can, stop dynamic_server and check the logs for compromise

This is a "local" privilege escalation, but in real attacks it was the last step after getting into the portal, turning a foothold into root. When the perimeter firewall is rooted, the device meant to protect your traffic becomes the attacker's base. Do not defer it because it is local.

Check your Gaia version and Jumbo Hotfix take, and update to the fixed take or later.
Where you cannot update yet, use the advisory's workaround to stop dynamic_server (some Dynamic CLI commands stop working while it is off).
If you expose Mobile Access or other remote access features, confirm the fixes for those are applied too (separate CVEs; see below).
Check /var/log/dynamicCli.log and the other items below for signs of compromise.

A short, three-day deadline

The KEV due date is three days after it was added (16 November). Organizations outside CISA's scope are not bound by it, but since exploitation is confirmed, the date works as a "latest by" guide.

What the vulnerability is

Check Point's advisory explains that a root-owned process (dynamic_server) listens on a world-writable (permissions 0777) local socket, does not authenticate the connecting process, and runs the command strings it receives as root. So anyone who gets low-privilege code execution on the appliance can obtain root.

Exploitation needs prior code execution on the appliance (AV:L and PR:L in the CVSS vector). On its own, the flaw cannot be attacked directly from the outside.
Ways to get that code execution include other vulnerabilities or stolen credentials. The chain seen in real attacks is described below.
The specific way of calling the service is not in the advisory, and this site does not describe it.

Scope

Item	Detail
Products	Force Firewalls, Management and Log Servers, Multi-Domain Security Management and Multi-Domain Log Server, Maestro Orchestrator
Versions (advisory)	R82.20, R82.10, R82, R81.20, R81.10, R81
Fix	Jumbo Hotfix Accumulator: R82.20 Take 14, R82.10 Take 52, R82 Take 132, R81.20 Take 174 or later
No fix	R81.10, R81 (both EOS; no fix take in the advisory)
Not affected	Spark Firewalls, Smart-1 Cloud
Workaround	Stop dynamic_server (some Dynamic CLI commands then fail)

The CVE record lists affected versions as "R82.10 with Jumbo Hotfix Take 50 or below", "R82.20 with Take 10 or below", "R82 with Take 130 or below" and "R81.20 with Take 173 or below". How to treat the numbers between that and the advisory's fixed take (for example R82.10 Take 51) cannot be settled from either record, so align on the fixed take or later.
The CVE record does not list R81.10 and R81, but the advisory does. If you run end-of-support versions there is no fix, so plan a migration.
Around the same time, Check Point published other vulnerabilities in the same attack family (see below).

How to check whether you are affected

Check the Gaia version and Jumbo Hotfix take

Note each device's Gaia version (R81.20, R82 and so on) and the Jumbo Hotfix Accumulator take applied. At or above the fixed take (R82.20: 14, R82.10: 52, R82: 132, R81.20: 174) the flaw is fixed. List not only firewalls but also Management Servers, Log Servers and Maestro Orchestrators (asset inventory checklist).

Confirm the fix through the socket's permissions

Per the advisory, after the fix, listing /tmp/dynamic_socket in expert mode shows owner root, group config and mode 0660 (srw-rw----). If it still shows 0777, the fix is not in effect.

Check whether dynamic_server is running

To decide whether to use the workaround, check in expert mode whether the dynamic_server process is running (the advisory gives the command).

Check which remote access features are exposed

Check whether Mobile Access, Remote Access VPN or any other internet-reachable feature is enabled. If it is exposed, it can be the entry point of the chain.

What to do today

Update the Jumbo Hotfix to the fixed take or later (top priority)

R82.20: Take 14, R82.10: Take 52, R82: Take 132, R81.20: Take 174 or later. This includes Management Servers, Log Servers and Maestro Orchestrators. The KEV due date is 16 November. If a reboot or a cluster failover is needed, confirm it in the advisory and your runbook before proceeding.

Apply the workaround on devices you cannot update

The advisory shows how to stop dynamic_server and keep it from starting again after a restart (a dbset setting in expert mode). While it is stopped, the Dynamic CLI commands listed in sk144112 fail, so first check whether any operation (automation, for example) depends on them. After updating, you can re-enable it with the advisory's steps.

Check exposure and fixes for Mobile Access and other remote access features

Check Point's research reports that in real attacks the way in was a different Mobile Access portal vulnerability (PHP2Shell: CVE-2026-109618 and CVE-2026-109619). Check Point's official blog recommends installing the November Jumbo Hotfix and says the PHP2Shell fix (a hotfix available since 23 October) is included in it. The fixed takes for this flaw come from sk1000362 (see the table above), not from the blog. Update internet-facing Mobile Access first, and turn off external-facing features you do not use. The PHP side is covered in two critical PHP vulnerabilities and the emergency fixed versions.

Check for signs of compromise

Check Point's advisory says dynamic_server logs the commands it receives to /var/log/dynamicCli.log and shows how to search that log (use the advisory's grep conditions). The points to look at: whether any received command lacks the usual Clish form (the prefix string the advisory shows), and whether there are records of connections rejected from unauthorized UIDs, which appear after the fix (an unexpected UID such as 99, "nobody", indicates a blocked escalation attempt; correlate with portal, web and authentication logs to find the entry point).

For PHP2Shell, Check Point's official blog lists traces such as session files in the Mobile Access temporary directory, processes and files named to look like Check Point components, scanning or wiping tools under /tmp, and unexplained gaps in firewall traffic logs. It says that no match does not rule out compromise and that a match warrants immediate investigation. See the Check Point Research article for the detailed indicators.

If compromise is suspected, do not stop at the appliance

Check Point's research reports cases where, after obtaining root, the attackers scanned internal assets from the device, moved to a virtualization host (VMware ESXi) and destroyed data. If you find signs on a device, work in one pass through rotating the device's credentials and service-account keys, checking logs on internal hosts (especially virtualization hosts), and confirming that backups are isolated (how to check for intrusion, backup and recovery essentials, least privilege for SSH keys).

Exploitation status

Check Point's advisory says it observed active exploitation against "a couple of dozen" customers. Its official blog says the compromised devices were unpatched and concentrated in a single region.
Check Point's official blog says exploitation was observed from 30 October to 4 November. Check Point Research reports that the first wave, on 30 October, included destructive activity against some targets, and that the second wave, on 2 November, spanned several countries and sectors with no destruction observed.
The chain: Check Point Research reports that attackers got in through PHP2Shell on the Mobile Access portal, then used this flaw to go from the portal's service account to root. After root, web shells, a persistent backdoor and an internal scanner were placed, and in some cases a wiper was run on a virtualization host.
CISA added it to KEV on 13 November 2026 with a due date of 16 November (KEV version 2026.11.13). The KEV name is "Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability".
KEV lists ransomware use as Unknown and Forensic Triage as Yes.
The CVE record carries CISA's assessment (exploitation: active, automatable: no, technical impact: total).
This site does not cover attribution or motives, and does not name affected organizations.

Check Point's official blog tabulates the fixes from the same period (it gives no Jumbo take numbers).

CVE	Description	CVSS	Exploited
CVE-2026-123039	Local privilege escalation in Gaia OS Dynamic CLI (this article)	7.8	Yes
CVE-2026-109618, CVE-2026-109619	PHP2Shell: unauthenticated remote code execution through web interfaces such as Mobile Access	9.2	Yes (in CISA KEV)
CVE-2026-107484	Privilege escalation by an authenticated user in Gaia Portal backend handlers	7.3	No
CVE-2026-120490	Management-to-gateway privilege boundary bypass via NAT rules	3.8	No

For PHP2Shell, the blog gives the affected range as all versions R80 to R82.20 of Security Gateways (Mobile Access portal) and some Spark Firewalls.
The exploited column reflects the blog as of its publication (12 November).

Sources

Check Point — sk1000362 (CVE-2026-123039) (affected products and versions, fixed takes, workaround, how to check, exploitation statement)
Check Point — Security Advisory: Active Exploitation of PHP2Shell and Local Privilege Escalation (12 November 2026; related CVEs, the November Jumbo Hotfix, what to check)
Check Point Research — PHP2Shell Exploitation on Check Point Gateway (timeline and chain)
CVE.org — CVE-2026-123039 (published 12 November 2026; includes CISA's addition)
NVD — CVE-2026-123039
CISA KEV — Known Exploited Vulnerabilities Catalog (added 13 November, due 16 November)
BleepingComputer — Check Point warns of zero-day flaw exploited for root access (press report, cross-checked against the primary sources above)

Apart from setting names and log locations given in the advisory, no attack steps are included. Last verified: 14 November 2026.

FAQ

QWhat is CVE-2026-123039?

A local privilege escalation in Check Point's Gaia OS. Per Check Point's advisory (sk1000362), the root-owned dynamic_server listens on a world-writable (0777) local socket, does not authenticate the connecting process, and runs the command strings it receives as root. An authenticated local user who can run code on the appliance can obtain root. CVSS v3.1 is 7.8 (High).

QWhich products and versions are affected, and what is the fix?

The advisory lists Check Point Force Firewalls, Management and Log Servers, Multi-Domain Security Management and Multi-Domain Log Server, and Maestro Orchestrator, on R82.20, R82.10, R82, R81.20, R81.10 and R81. The fix is the Jumbo Hotfix Accumulator: R82.20 Take 14, R82.10 Take 52, R82 Take 132, R81.20 Take 174 or later. No fix take is listed for R81.10 and R81, both marked end of support (EOS). Spark Firewalls and Smart-1 Cloud are not affected.

QCan it be attacked remotely?

The flaw itself is a local privilege escalation and needs prior code execution on the appliance (AV:L in the CVSS vector). However, Check Point's research reports real attacks in which intruders first got onto the device through another Mobile Access portal vulnerability (PHP2Shell) and then used this flaw to become root. If another way in exists from the outside, the path can run from remote entry all the way to root.

QIs there a workaround if I cannot install the fix yet?

Yes. The advisory describes stopping the dynamic_server process and keeping it from restarting (using dbset commands in expert mode; see the advisory for the steps). While it is stopped, the Dynamic CLI commands listed in sk144112 fail. The advisory also gives the steps to re-enable it.

QIs it already being exploited?

Yes. Check Point says it observed active exploitation against a couple of dozen customers. CISA added it to KEV on 13 November 2026 (due 16 November). KEV lists ransomware use as Unknown and Forensic Triage as Yes.

QHow do I check whether a device was compromised?

Check Point's advisory shows how to examine /var/log/dynamicCli.log, where dynamic_server records the commands it receives. Look for commands that lack the expected Clish form and for records of connections rejected from unexpected UIDs. An empty result does not prove there was no compromise, so combine it with the checks below.