Check Point Gaia flaw CVE-2026-123039 exploited with PHP2Shell, in KEV

Developing story, updated as details confirm.

What happened

Check Point’s advisory sk1000362 says CVE-2026-123039 (CVSS 7.8, High) lets any authenticated local user on Gaia OS run commands as root through a world-writable Dynamic CLI socket. CISA added it to its Known Exploited Vulnerabilities catalog on November 13, with a November 16 federal deadline, and flags it for forensic triage.

Check Point Research says attackers broke in through the Mobile Access portal with PHP2Shell from October 30, then used this flaw to get root. In some cases they moved to a VMware ESXi host and ran a wiper. Check Point’s advisory says a couple of dozen unpatched systems were compromised.

Who’s affected

For CVE-2026-123039, Check Point lists Security Gateway, Firewall, Security Management Server, Multi-Domain and Scalable Platforms on R81 through R82.20. Spark firewalls and Smart-1 Cloud are not affected by this flaw, but Check Point’s blog lists Spark as affected by PHP2Shell. MSP-run firewalls may be exposed.

What to do now

1. Install the November Jumbo Hotfix on management servers and gateways, internet-facing Mobile Access gateways first. This flaw is fixed from R82.20 Take 14, R82.10 Take 52, R82 Take 132 and R81.20 Take 174. R81 and R81.10 are end of support with no listed fix; the mitigation is stopping dynamic_server.
2. Review who has local or shell accounts on each gateway.
3. Run Check Point’s /var/log/dynamicCli.log checks and its published indicators, or ask your MSP to.

See our emergency patch checklist and more news.

Updates

• Nov 14, 2026, 8:28 a.m. Manila (UTC+8): Added Check Point Research’s account of the PHP2Shell exploit chain and the ESXi wiper, and Check Point’s advisory blog; clarified that Spark firewalls are unaffected by CVE-2026-123039 but listed as affected by PHP2Shell.
• Nov 14, 2026, 7:03 a.m. Manila (UTC+8): Initial report, from Check Point’s sk1000362 advisory and CISA’s KEV catalog entry.

Sources & method

• Check Point Research, “PHP2Shell Exploitation on Check Point Gateway” (November 12, 2026) — https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/
• Check Point Blog, “Security Advisory: Active Exploitation of PHP2Shell and Local Privilege Escalation” (November 12, 2026) — https://blog.checkpoint.com/security/security-advisory-active-exploitation-of-php2shell-and-local-privilege-escalation/
• Check Point, “sk1000362 - CVE-2026-123039 - Local privilege escalation to root in the DynamicCLI process via local world-writable control socket” (last modified November 12, 2026) — https://support.checkpoint.com/results/sk/sk1000362
• CISA, Known Exploited Vulnerabilities Catalog (CVE-2026-123039, added November 13, 2026, due November 16, 2026) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Last checked: Nov 14, 2026, 8:28 a.m. Manila (UTC+8). Method: We read Check Point’s sk1000362 advisory, CISA’s KEV catalog entry and alert, and Check Point’s research and blog posts at about 8:28 a.m. Manila (UTC+8). Versions, fixes and checks are as Check Point lists them; we did not add steps of our own beyond reviewing accounts. Thumbnail is a reuse-licensed photograph, cropped and resized, credited with its license under the picture. No affiliate links. How we work.