Check Point Gaia Zero-Day CVE-2026-123039: Patch Firewall Exploit Chain and Hunt for Compromise

What the flaw actually is​

The bug is simple. The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket, /tmp/dynamic_socket, without authenticating the processes that connect. Any authenticated local user can send commands to that socket and have them run as root.

The CVE record classifies it as incorrect permission assignment for a critical resource (CWE-732) and missing authorization (CWE-862). It carries a CVSS 3.1 score of 7.8 (High), with a local attack vector and low privileges required.

That score is a reminder that "local" is not the same as "harmless". On its own, the bug needs a foothold. Chained with a remote entry point, it turns a modest foothold into full control of the box.

The attack chain Check Point observed​

Check Point's advisory and research describe a multi-stage intrusion:

1. Initial access via PHP2Shell. The attackers first reached the Mobile Access portal by exploiting the PHP2Shell vulnerability. Check Point tracks PHP2Shell as CVE-2026-109618 and CVE-2026-109619. It rates them 9.2 and describes them as unauthenticated remote code execution through firewall web interfaces.
2. Escalation to root. The attackers moved from the portal service account to root by exploiting CVE-2026-123039, then deployed PHP web shells to establish persistent access.
3. Persistence and tooling. They dropped webshells and installed the TSGA backdoor and TSProxy malware, which was previously seen in attacks on Ivanti appliances. Check Point's research describes these as modified variants of the PhiliKit framework.
4. Lateral movement and destruction. From the compromised gateway, the attackers pivoted to a VMware ESXi host and deployed destructive wiper malware.

Timeline and scale​

Check Point says exploitation ran from October 30 to November 4. The first wave targeted Israeli organizations, and some of those cases involved destructive activity. A broader scanning wave followed on November 2. It hit additional organizations in several countries and sectors, with no evidence of destructive activity in that wave.

On scale, Check Point says it "observed an active exploit of this vulnerability against a couple of dozen customers." Its blog adds that the compromised systems were unpatched and in a single region.

Attribution is unsettled​

Check Point is cautious here. It says the evidence does not let researchers confidently identify the actor or its motive. The research leaves open whether destructive activity was the goal or a smokescreen. A ransom-style note referencing "Dream Annexation" appeared with no payment demand, and Check Point explicitly declines to infer a motive from it. Treat any firm attribution you read elsewhere with skepticism.

Who is affected and what to install​

Check Point's advisory lists Gaia versions R81.20, R82, R82.10 and R82.20 as affected. A Check Point community post says exposure covers Management, Multi-Domain, Log Servers and Security Gateways, across R80.30 through R82.20. A secondary report (The Hacker News follow-on coverage syndicated by lavx) lists R81.10 and R81 as well. Those ranges don't fully agree, so check your own version and Jumbo Hotfix level against the vendor's SK article rather than relying on any one list.

The CVE record is more specific on builds. It lists these as affected: R82.10 with Jumbo Hotfix Take 50 or below, R82.20 with Take 10 or below, R82 with Take 130 or below, and R81.20 with Take 173 or below. If you are at or under those takes, you are exposed.

Check Point's R82 release notes say Jumbo Hotfix Take 132, released November 12, 2026, resolves CVE-2026-123039. The same take also resolves:

• the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619)
• CVE-2026-107484, a Gaia Portal input-validation privilege escalation
• CVE-2026-120490, a NAT-related Sync-network protection bypass on Scalable Platforms

Take 132 is also a general maintenance release, with dozens of unrelated fixes. One of them addresses APPX packages arriving without a file extension being mishandled by Content Awareness, which caused Windows 11 updates to fail. Other branches have their own take numbers, so confirm the right one for your release.

Two of those bundled vulnerabilities are not known to be exploited. CVE-2026-107484 is rated 7.3 and CVE-2026-120490 is rated 3.8. Don't conflate them with the zero-day.

Spark firewalls​

Check Point's community advisory says Spark Firewalls are not affected by the three newly published Gaia and Scalable Platform CVEs. They are affected by the PHP RCE flaws, and Check Point's guidance is to install the latest GA version.

Mitigation if you can't patch today​

Check Point advises teams that can't deploy the hotfix immediately to stop the dynamic_server process and prevent it from restarting. The community advisory adds a caveat: do this only if losing Dynamic CLI functionality is acceptable. The step-by-step procedure is in Check Point's SK1000362, which you should follow rather than improvise.

Treat this as a stopgap. It closes the local path to root but does nothing about the PHP2Shell entry point.

Hunting for compromise​

Check Point has published indicators of compromise. Its advisory lists:

• PHP session files containing the string upload_progress_pwn
• a process or binary masquerading as a Check Point component named like CPconfigdaemon
• scanning or wiper tooling under /tmp or /temp, with scanner or wiper in the filename
• a ransom-style note referencing "Dream Annexation" with no payment demand
• unexplained gaps in firewall traffic logs, especially after a logging-daemon crash
• reconnaissance source addresses 130.94.19[.]204 and 130.94.19[.]168

Check Point also says exploitation shows up in logs as commands that don't use the default Clish wrapper, and as use of the system() sink, which is uncommon in legitimate traffic. It says absence of a match doesn't rule out compromise, and a match warrants immediate investigation.

Practical priorities for admins​

1. Identify every Gaia system, including management, log and Multi-Domain servers, and record its release and Jumbo Hotfix take.
2. Patch internet-facing gateways with Mobile Access enabled first, since that's where the observed chain began.
3. Apply the matching Jumbo Hotfix, or use the dynamic_server mitigation as a temporary measure where Dynamic CLI loss is tolerable.
4. Hunt for the indicators above, and review firewall log gaps.
5. Check your virtualization layer. If a gateway was compromised, review SSH access from it to ESXi hosts, since that was the pivot in the destructive cases.

Patching caveats from the field​

The Check Point community thread shows mixed experiences. One admin reported the hotfix being unstable on a firewall pair, with loss of HA after the PHP hotfix was removed first. Tech support told another admin that the earlier PHP patch doesn't need to be uninstalled before applying the Jumbo Hotfix. Another asked about AWS AMI availability. These are individual forum reports, not vendor findings. They are still good reasons to take snapshots and stage the update on a standby member before touching production.

The bigger picture​

This is the second time since September that Check Point has dealt with zero-day exploitation of its own gear. In September, it warned that attackers were exploiting two other critical remote code execution flaws, CVE-2026-93616 in Security Management Server and CVE-2026-85102 in Security Gateway, in zero-day attacks. Over the past two years CISA has added five Check Point flaws to its catalog of actively exploited vulnerabilities, two of which ransomware gangs also abused.

The pattern is familiar to anyone who has patched Ivanti, Fortinet or Citrix edge devices. Security appliances sit in the most exposed place on the network, hold privileged credentials, and often get patched on a slower cadence than endpoints. The reuse of PhiliKit-derived malware, previously seen against Ivanti appliances, underlines how attackers treat these devices as one category.

One more detail matters here. Check Point says fixes for the PHP2Shell issue were available from October 23, about a week before the observed attacks. The attackers' window was real, but so was the patch. Slow edge-device patching is the cheapest gift you can give an intruder.