78 openlast updated

HomeNovember 2026 patch cycleCVE-2026-123039: Check Point Gaia root bug exploited

Patch nowEnterprise

CVE-2026-123039: Check Point Gaia root bug exploited

Part of November 2026 patch cycle

Vendor
Check Point, PHP
Products
Check Point Gaia OS R81 / R81.10 / R81.20 / R82 / R82.10 / R82.20, Check Point Force Firewalls (Security Gateways), Security Management and Log Servers, Multi-Domain Security Management and Multi-Domain Log Server, and Maestro Orchestrator
Published
Status
Open

Call: Patch now. It’s being exploited. Check Point says attackers used PHP2Shell to get into the Mobile Access portal on unpatched internet-facing gateways, then used CVE-2026-123039 to go from the portal’s service account to root. Check Point saw this against “a couple of dozen customers” between Oct 30 and Nov 4. In some cases, it says, the attackers went on to wipe things. The fix is in the November Jumbo Hotfix. Install it on gateways and management servers, internet-facing Mobile Access first.

What breaks: Nothing, which is the problem. Gaia’s Dynamic CLI is served by dynamic_server, which runs as root and listens on /tmp/dynamic_socket. On affected versions, the socket is world-writable (0777) and doesn’t check who’s connecting, so any local user can send it a command and have it run as root. It needs local code execution first (CVSS 7.8), and PHP2Shell provided that. Check Point Research says that after getting root, the attackers dropped PHP webshells for persistence. In at least one case they moved over SSH to a VMware ESXi host and ran a wiper.

Who’s hit: Gaia R81, R81.10, R81.20, R82, R82.10 and R82.20 on Check Point Force Firewalls (Security Gateways), Management and Log Servers, Multi-Domain Security Management and Log Servers, and Maestro Orchestrator. Spark firewalls and Smart-1 Cloud aren’t affected. Check Point says the PHP2Shell hotfix has been out since Oct 23, and that the boxes compromised were ones that never got it.

Fix (from sk1000362):

  • R82.20: Jumbo Hotfix Take 14 or later
  • R82.10: Jumbo Hotfix Take 52 or later
  • R82: Jumbo Hotfix Take 132 or later
  • R81.20: Jumbo Hotfix Take 174 or later

The SK doesn’t list a Jumbo for R81 or R81.10. If you’re still on either, plan the upgrade, and use the mitigation until then.

Workaround: Stop dynamic_server and keep it from restarting with dbset process:dynamic_server followed by dbset :save. The Dynamic CLI commands listed in sk144112 stop working while it’s off. To check it worked, ls -l /tmp/dynamic_socket on a fixed box should show srw-rw---- root config, not srwxrwxrwx.

Check for compromise: After the Jumbo is on, grep "Rejected connection from unauthorized uid" /var/log/dynamicCli.log shows blocked attempts. A UID like 99 (nobody) means someone tried. Line those times up with portal and authentication logs. Check Point’s research post has more IOCs. If your Mobile Access portal went without the PHP2Shell hotfix from Oct 23 into November, go looking whether or not anything was logged.

Sources: Check Point sk1000362, Check Point advisory, Check Point Research, BleepingComputer, R82.10 Jumbo Take 52 notes.

Sources

More from November 2026 patch cycle