On this page
Attackers broke into unpatched Check Point firewalls at the end of October, took full control of them, and in some companies went on to wipe servers behind them. CISA added the bug that gave them full control, CVE-2026-123039, to its Known Exploited Vulnerabilities catalog on November 13, 2026, with a November 16 deadline for federal agencies. Check Point says a couple of dozen gateways were compromised. If you run Check Point, install this month's Jumbo Hotfix, then check the box for signs it was already entered.
CVE-2026-123039 is a local privilege escalation in the Gaia OS DynamicCLI service (CVSS 3.1 7.8). On its own it needs a foothold on the box. In the attacks Check Point Research investigated, that foothold came from PHP2Shell in the Mobile Access portal. This post is the operator read of Check Point's November 12 advisory and research write-up. The HOL Guard evidence pack for CVE-2026-123039 is the source record.
How to fix
Install the November Jumbo Hotfix Accumulator for your release on every Security Gateway, Management Server, Multi-Domain Server and Log Server. These are the first takes whose release notes list CVE-2026-123039 as resolved:
- R82.20: Take 14 or later
- R82.10: Take 52 or later
- R82: Take 132 or later
- R81.20: Take 174 or later
Check the installed take in expert mode:
cpinfo -y allLook for the HOTFIX_..._JUMBO_HF_MAIN line and its take number. The same takes also roll up the October PHP2Shell hotfix (sk1000302) and the Gaia Portal privilege bug CVE-2026-107484, so one install covers the whole chain.
The DynamicCLI daemon listens on /tmp/dynamic_socket, and the bug is that any local process can write to it. A quick sanity check after patching:
ls -l /tmp/dynamic_socketIf the permission string ends in rwx for everyone, the box is still unfixed. If you can't patch today and can live without Dynamic CLI, Check Point's interim step is to stop dynamic_server and keep it from restarting. The exact steps are in sk1000362.
Patch first, then look for a break-in
Exploitation started on October 30, a week after the PHP2Shell hotfix shipped, and Check Point saw it active until November 4. A gateway that was patched for PHP2Shell after October 30 can be clean of the bug and still hold the attacker. Installing the Jumbo does not remove anything they left. Check Point Research lists these traces:
- PHP session files containing
upload_progress_pwnunder/opt/CPcvpn-R81.20/tmp/(or the matching path for your release), plus hundreds of Apache/PHP segmentation faults in the portal logs around the same time. - Template files named
zz*.tplorchallenge_render.tplin the Mobile Access login page directory. These were the web shells. /tmp/CPconfigdaemon, a process namedslot_CPconfigdaemon, or/lib/libcpfwcommon.so. That is the TSGA backdoor and its TSProxy library.- A listener on TCP port 11072 or a Unix socket at
/tmp/.p_sock. - Gaps in firewall traffic logs, especially after a crash of the logging daemon. TSGA can tamper with binary firewall logs.
- Connections from 130.94.19.204 or 130.94.19.168.
One detail matters for cleanup. Check Point Research says TSGA has backup and snapshot persistence. Restoring a Gaia snapshot or backup taken after October 30 can bring the backdoor back. If you find any of the traces above, rebuild from a snapshot that predates October 30 or from clean media, then rotate every credential the gateway held, including the accounts it uses to reach other systems.
Why the firewall was only the first stop
In the case Check Point Research documented, the attackers scanned the internal network from the gateway, then logged in to a VMware ESXi host over SSH with the vpxuser service account and ran a wiper called destroy_v6. The note they left, DREAM_ANNEXATION.txt, asks for no ransom. If your gateway shows signs of entry, treat the hypervisors and servers it could reach as part of the same incident. We covered the ESXi angle of hiding attacker activity in CVE-2026-41709.
Check Point Research ties the backdoor to PhiliKit, a toolset previously seen against Ivanti VPN appliances, but says it cannot attribute the operation with confidence.
Who is not in scope
- Gateways already on the takes listed above.
- Quantum Spark small-business appliances. Check Point lists them for PHP2Shell, not for the DynamicCLI bug, so they still need the PHP2Shell fix.
- For the attack chain itself: gateways without the Mobile Access portal exposed to the internet. Check Point's guidance is to prioritize internet-facing Mobile Access deployments. CVE-2026-123039 still needs patching on every box, because any other foothold works too.
What this is not
CVE-2026-123039 is not a remote, no-login bug by itself. An attacker needs to be running code on the appliance first, as a local user or through another hole like PHP2Shell. It is also not a fresh zero-day for patched customers: the PHP2Shell fix that blocked the entry point was out on October 23, and Check Point says the compromised systems were unpatched.
What do people ask about CVE-2026-123039?
Which Check Point versions fix CVE-2026-123039?
The November Jumbo Hotfix takes: R82.20 Take 14, R82.10 Take 52, R82 Take 132 and R81.20 Take 174, or later.
Is CVE-2026-123039 being exploited?
Yes. Check Point reported exploitation in the wild on November 12, 2026, chained with PHP2Shell, and CISA added it to the Known Exploited Vulnerabilities catalog on November 13, 2026 with a due date of November 16.
Is there a workaround for CVE-2026-123039?
If losing Dynamic CLI is acceptable, Check Point says you can stop dynamic_server and prevent it from restarting until you install the Jumbo. Steps are in sk1000362.
I installed the PHP2Shell hotfix in October. Am I covered?
Not for CVE-2026-123039. The October hotfix closed the PHP2Shell entry point. The DynamicCLI fix ships in the November Jumbo takes. If the box was exposed between October 30 and your patch date, check it for the traces above as well.
Does patching remove a backdoor that is already there?
No. Patching stops new break-ins. A gateway that was entered needs to be rebuilt from a known-clean state, and its credentials rotated.
Related
- PHP2Shell is on CISA's exploited list: patch and check for a break-in (CVE-2026-109618)
- PHP2Shell lets attackers run code on PHP web servers with no login
- VMware ESXi zero-day hid attacker commands from the logs (CVE-2026-41709)
- Barracuda email gateways exploited, on CISA KEV (CVE-2026-116606)
- HOL Guard CVE feed
