Check Point Vulnerability CVE-2026-123039: Exploited Gateway Flaw Gives Attackers Root, Wiper and Backdoors Found, and the Jumbo Hotfix Takes to Install

Attackers are breaking into Check Point Security Gateways and getting root, which means full control of the firewall. Some victims then had backdoors and a data-wiping program planted on them. If your business runs Check Point on any release from R81 through R82.20, check your Jumbo Hotfix level this week. Check Point has confirmed that real customers were hit through the root flaw.

This post covers what happened on Check Point gateways and what to do now. For background on PHP2Shell, the name the malware.news write-up gives this campaign, see our earlier posts on the PHP2Shell vulnerability and why updated is not the same as patched.

What happened to Check Point firewalls

According to the reports, the campaign began on October 30, 2026. The first wave, on October 30, targeted Israeli organizations and included destructive activity against some of them. A later wave reached additional organizations worldwide, with no apparent focus on Israel. The reports do not give a date for the second wave.

The attack works as a chain of flaws:

1. Getting in. Attackers first reached the gateway's portal service account. The malware.news write-up associates this activity with CVE-2026-109618 and CVE-2026-109619.
2. Getting root. In the reported words: "After reaching the portal service account, attackers exploited CVE-2026-123039 to run commands as root." This flaw is in the DynamicCLI service of the Gaia operating system, and it is rated 7.8.
3. Staying and spreading. With root on the gateway, the attackers installed a backdoor and ran a scanner to map the internal network. On some victims they also ran a wiper.

What is confirmed and what is not

Confirmed by Check Point, as reported:

• Check Point confirmed that attackers exploited the privilege escalation flaw against "a couple of dozen customers."
• Check Point lists affected releases from R81 through R82.20, including management, logging, and Maestro products.
• Fixed Jumbo Hotfix releases begin at R82.20 Take 14, R82.10 Take 52, R82 Take 132, and R81.20 Take 174.

Reported by researchers:

• The two waves and their targets, described above.
• The malware and tools found on hacked gateways, described below.

Not known from the sources:

• Which organizations were hit, or how many in each wave.
• Whether a fixed take exists for releases in the affected range other than the four listed.
• Which systems beyond the gateway the wiper reached in each case.
• Who rated the flaw 7.8. The reports give the number but do not say which scoring system produced it.
• Who is behind the campaign.

The facts in this post come from two security news reports that cite Check Point and the researchers. We did not have Check Point's own advisory text to quote, so confirm your exact release and take with Check Point before you change anything.

Malware found on hacked Check Point gateways

The malware.news write-up names four tools. If you run Check Point, these are the names to watch for:

The scanner is the part business owners should notice. The attackers did not stop at the firewall. They used it as a base to map out everything behind it.

Which Check Point versions are fixed

If your gateway is below the take for its release, it is exposed. Management, logging and Maestro products are on the affected list too, so check all of them, not only the gateway at the edge.

What to do this week

• List every Check Point system. That means gateways, management servers, logging servers and Maestro. Write down each one's release and installed Jumbo Hotfix take.
• Compare against the table. Anything below the fixed take for its release needs the update.
• Install the fixed Jumbo Hotfix. Plan a maintenance window if you need one, but do not let it slip past this week.
• If you cannot patch yet, use the workaround. In the reported words: "Temporarily stopping dynamic_server blocks this route but turns off Dynamic CLI commands." Ask Check Point or your firewall administrator for the exact steps for your release, and expect some management commands to stop working until you turn it back on.
• Look for signs of compromise. Installing the update closes the hole, but it does not remove an implant that is already there. Check gateways for anything named slot_CPconfigdaemon, destroy_v6 or a gogo scanner. If you find one, treat that gateway as compromised and bring in incident response before you rebuild it.
• Test your backups. A wiper destroys data rather than stealing it. Make sure at least one backup copy is offline or cannot be reached from the network, and confirm you can actually restore from it.
• Review what the firewall can reach. If a hacked gateway can talk to every server on your network, a scanner on it sees everything. Limit its access to what it needs.

Why this matters for a business network

Your firewall is the device every connection passes through. Root on the firewall puts an attacker between your staff and the internet, with a view of your internal network. Most companies trust that device more than any other on the network, and few watch it closely. This campaign shows the cost: a backdoor that survives, a scanner that maps your servers, and on some victims a wiper.

If nobody at your company owns firewall patching, this is the week to decide who does. Our post on who is patching the software that runs your business covers how to assign that job so it does not fall through the cracks.

Check Point vulnerability questions people are asking

Is the Check Point vulnerability being exploited?

Yes. Check Point confirmed that attackers exploited the privilege escalation flaw against a couple of dozen customers.

What is CVE-2026-123039?

It is a privilege escalation flaw in the DynamicCLI service of Check Point's Gaia operating system. Once attackers had the portal service account, it let them run commands as root. It is rated 7.8.

Which Check Point versions are affected?

Check Point lists releases from R81 through R82.20, including management, logging and Maestro products.

Which Jumbo Hotfix fixes it?

R82.20 Take 14, R82.10 Take 52, R82 Take 132 and R81.20 Take 174, or later takes. For other releases in the affected range, the reports list no fixed take, so ask Check Point.

Is there a workaround if I cannot patch?

Temporarily stopping dynamic_server blocks the exploit route. It also turns off Dynamic CLI commands until you start it again.

Does patching remove the malware?

No. Installing the update stops new attacks through this flaw. A gateway that was already hacked can still hold the TSGA backdoor, so check for it and rebuild if you find it.

Who was targeted?

Israeli organizations in the first wave, some with destructive activity. The second wave hit additional organizations worldwide, with no apparent focus on Israel.

Is this connected to PHP2Shell?

The malware.news write-up describes this as PHP2Shell exploitation on a Check Point gateway and associates it with CVE-2026-109618 and CVE-2026-109619. Our PHP2Shell post explains that flaw itself.

The bigger lesson

A security device is still software, and software needs patching. This campaign reached root on the box meant to keep attackers out, then used it to plant backdoors and map the network behind it. Patch the firewall like any other server, check it for signs of compromise, and keep a backup the network cannot reach.

See how we approach security hardening, or ask for a quote to have your firewall and servers reviewed.

Get security alerts like this by email, with our free checklist, at /security-alerts.

Sources: Cyber Security News; Malware News.