Check Point says attackers exploited Gateway flaw for root access

Check Point has disclosed that CVE-2026-123039 was exploited against a “couple of dozen customers” to escalate privileges on Check Point Gateway devices running Gaia OS. The researchers say attackers gained root access by exploiting a local user vulnerability in Gaia’s DynamicCLI service after breaking in via two PHP flaws, CVE-2026-109618 and CVE-2026-109619, associated with PHP2Shell on the Mobile Access portal.

In at least some Israeli targets, the intruders placed backdoors and, in a subset of cases, deployed a wiper. The activity was observed beginning on 30 October 2026, with a broader wave on 2 November; Check Point notes this occurred roughly one week after a security fix became available and that some victims were unpatched at the time.

The flaw in Gaia DynamicCLI allows an authenticated local user to run arbitrary commands as root by writing a single request to a world-writable local socket, once PHP2Shell has established code execution on the portal service account. Check Point’s bulletin lists affected products and versions including Gaia R82.20, R82.10, R82, and earlier R81.20, R81.10 and R81 across Check Point Force Firewalls, Management and Log Servers, and related appliances.

The recommended fix is to install Jumbo Hotfix takes: R82.20 Take 14 and later, R82.10 Take 52 and later, R82 Take 132 and later, and R81.20 Take 174 and later; guidance also covers mitigations such as stopping the dynamic_server daemon and reviewing /var/log/dynamicCli.log for unusual commands. Check Point Research stops short of definitive attribution, noting the evidence does not allow reliable identification of the threat actor.