Check Point Zero-Day Fix

Check Point says attackers are using CVE-2026-123039, a flaw in its firewalls and management servers, to get full root control of devices. On November 13, 2026, CISA added it to its Known Exploited Vulnerabilities catalog. If your company network sits behind a Check Point gateway, install the Jumbo Hotfix this week. If you cannot do that yet, switch off the vulnerable service until you can.

This post covers what to do now: the temporary fix for teams that cannot patch today, which products are and are not affected, the gap for older R81 releases, and what the CISA listing tells you.

What changed since the Check Point zero-day was first reported

Anyone running Check Point should know three things from the latest reporting:

• CISA has listed it. Cyber Security News reports that CISA "added CVE-2026-123039 to its Known Exploited Vulnerabilities catalog on November 13, 2026". That catalog lists flaws CISA knows attackers are already using, so this is no longer a theoretical risk.
• We know roughly how many customers were hit. BleepingComputer reports that "Check Point observed an active exploit of this vulnerability against a couple of dozen customers". The same report says the attacks have been going on since late October.
• There is a stopgap. BleepingComputer reports that customers who cannot install the hotfix right away can stop the dynamic_server process and prevent it from restarting.

One note on sourcing: everything here comes from reporting by BleepingComputer and Cyber Security News. We have not quoted Check Point's own advisory. Read it for your exact release before you make changes.

How the Check Point root access flaw works

BleepingComputer describes the cause like this: "The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket)". The report adds that the daemon does not check which processes connect to it.

In plain English, a socket is a channel that programs on the same device use to talk to each other. World-writable means any process on the device can use it. The service on the other end runs with full root rights and does not ask who is calling. So anything that reaches that socket can get root-level control. The flaw has a CVSS score of 7.8.

What is not known: the sources do not say how attackers first got onto the devices before they used the socket. They also do not say who is behind the attacks.

Which Check Point products are affected

The reports list these affected products: Force Firewalls, Management and Log Servers, Multi-Domain management and logging systems, and Maestro Orchestrator. The vulnerable releases are R81, R81.10, R81.20, R82, R82.10 and R82.20.

Not affected: Check Point Spark Firewalls and Smart-1 Cloud.

What to do if you are on R81 or R81.10

Both releases are listed as vulnerable, but the reports do not name a fixed Jumbo Hotfix for either one. Do not assume one exists, and do not assume you are safe. Ask Check Point or your reseller directly what they recommend for your release. In the meantime, apply the dynamic_server mitigation below. Then plan a move to a release that has a listed fix, such as R81.20 Take 174 or later.

How to stop dynamic_server until you can patch

The reported advice has two parts: stop the dynamic_server process, and stop it from restarting. BleepingComputer calls this a temporary mitigation measure.

The sources do not give the exact commands. They also do not say which features, if any, depend on this service. So:

1. Follow Check Point's own instructions for your release.
2. Try it on one device first, during a maintenance window.
3. After a reboot, check that the process has not come back. The mitigation only works if it stays stopped.
4. Install the hotfix as soon as you can. The workaround is not a substitute.

Check Point patch checklist for this week

• List every Check Point device you run: gateways, Management and Log Servers, Multi-Domain systems and Maestro Orchestrator.
• Write down the release and the Jumbo Hotfix Take installed on each one. The release number alone does not tell you if you are protected.
• Install at least the Take listed in the table above for your release.
• If you cannot patch today, stop dynamic_server, block it from restarting, and check again after any reboot.
• On R81 or R81.10, get a written answer from Check Point or your reseller, and apply the mitigation now.
• Check any device that was vulnerable from late October onward for signs of compromise.
• If you only run Spark Firewalls or Smart-1 Cloud, this flaw needs no action from you.

Why a firewall flaw matters for a business network

Your firewall is the device every connection passes through. An attacker with root on it controls the box that is supposed to keep them out. The reports say the attackers were also setting up persistence, meaning a way to keep their access. Management and Log Servers matter just as much, because they hold the policy and the records for every gateway they manage.

The hotfix closes the hole. The sources do not say it removes anything an attacker already installed. That is why the checklist includes checking devices that were exposed, not just patching them. We have written before about why updated is not the same as patched: here, a gateway on the right release but the wrong Take is still vulnerable. If nobody in your company clearly owns firewall updates, read about who is patching the software that runs your business.

Check Point zero-day questions people are asking

Is CVE-2026-123039 being exploited?

Yes. Check Point saw attacks against a couple of dozen customers, going back to late October. CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 13, 2026.

What is the CVSS score for CVE-2026-123039?

7.8.

Which Jumbo Hotfix fixes the Check Point vulnerability?

R82.20 Take 14, R82.10 Take 52, R82 Take 132 and R81.20 Take 174, or later Takes on each release.

Is there a fix for R81 and R81.10?

The reports list both as vulnerable but do not name a fixed Take. Ask Check Point and apply the mitigation in the meantime.

Are Check Point Spark firewalls or Smart-1 Cloud affected?

No. Both are reported as not affected.

Can I protect a Check Point gateway without the hotfix?

Only for now. Stopping dynamic_server and preventing it from restarting is described as a temporary mitigation.

Does installing the hotfix remove attackers who are already in?

The sources do not say it does. Patch, and also check any device that was exposed.

Who is exploiting the Check Point flaw?

The sources do not say.

The bigger lesson

On firewalls, the release number on the label tells you very little. Your protection depends on the exact hotfix Take installed on each device, and on someone checking it every time a new flaw is announced. Keep a list of every device, its release and its Take. Then exploited flaws like this one become a short job instead of a scramble.

For help with that, see security hardening or get a quote.

Get security alerts by email, with the free checklist, at our security alerts page.

Sources: BleepingComputer; Cyber Security News.