CISA Adds Check Point Gaia Zero-Day to Its KEV List

The US Cybersecurity and Infrastructure Security Agency added a Check Point Gaia local privilege-escalation flaw, CVE-2026-123039, to its Known Exploited Vulnerabilities catalogue on 13 November 2026, with a federal due date of 16 November. CISA’s KEV entry describes an incorrect permission assignment for a critical resource (CWE-732 and CWE-862) in multiple Check Point products, and says an authenticated local user can send a command to a world-writable local socket and have it executed as root.

Check Point’s support article sk1000362, last modified on 12 November, gives the flaw a CVSS score of 7.8 and says: “any authenticated local user can run arbitrary commands as root.” It also states that the issue “is a local privilege escalation and requires the attacker to already have local code execution on the appliance.” The company said it “observed an active exploit of this vulnerability against a couple of dozen customers.”

According to a 12 November advisory by Lotem Finkelstein, vice-president of research at Check Point, attackers first used PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which the company scores at CVSS 9.2, against the Mobile Access Portal for initial access, then used CVE-2026-123039 to obtain root privileges. The blog says that activity “dates back to October 30 and was observed as active until November 4,” and that a PHP2Shell fix had been available since 23 October.

Affected versions, official fixes and the interim mitigation

Check Point’s support article lists the affected versions as R81, R81.10 (both end of support), R81.20, R82, R82.10 and R82.20. The affected products are Force Firewalls, Management and Log Servers, Multi-Domain, and Maestro Orchestrator. Spark Firewalls and Smart-1 Cloud are not affected.

The company says the problem is fixed in Jumbo Hotfix R82.20 Take 14, R82.10 Take 52, R82 Take 132 and R81.20 Take 174. The support article describes those takes as the starting point of the fix in each Jumbo Hotfix Accumulator. It does not list a Jumbo Hotfix take for the end-of-support R81 and R81.10 trains.

The official interim mitigation is to stop the dynamic_server process, which Check Point says causes the Dynamic CLI commands listed in sk144112 to fail. The support article has the company’s exact commands and its guidance on how to re-enable the process. CISA’s required action is that agencies apply mitigations in accordance with the vendor’s instructions, with the 16 November due date.

The blog’s “single region” line and the research report’s second wave

The 12 November blog says: “Only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents.” That is the company’s blog wording, and it should be read alongside the longer technical report published the same day.

Check Point Research’s technical report describes two waves. The first, on 30 October, “targeted Israeli organizations and included destructive activity against some of them.” A “broader second wave on November 2 targeted organizations across multiple countries and sectors, with no evidence of destructive activity.” The report also says the second wave included some Israeli organisations that had been targeted in the first wave, “alongside additional organizations worldwide, with no apparent focus on Israel.”

Those two accounts are not interchangeable. The blog’s “couple of dozen” and “single region” figures are the company’s advisory summary. The research report’s second wave, across several countries, is a separate description from the same organisation’s technical write-up. This article reports each to its own source and does not treat the single-region line as a complete map of the activity.

The research report says that, after privilege escalation, operators deployed PHP webshells and a persistent backdoor, and that in the destructive first-wave cases they pivoted to a VMware ESXi host and used a wiper. Check Point Research says the evidence “does not allow us to assess with high confidence the true nature of this operation,” and that several scenarios remain plausible. This article names no attacker.

TSN has already covered earlier PHP2Shell activity, including honeypot logs of confirmed remote-code-execution attempts and an outage that took 32 UK government services offline. Those posts are about the PHP flaw and its earlier effects. They are not accounts of this Check Point Gaia privilege-escalation chain, and they should not be read as evidence of who carried out the gateway intrusions described this week.

A local escalation still needs a way in, and a KEV date is not an attribution

CVE-2026-123039 is a local privilege-escalation bug. Check Point’s own support article is explicit that an attacker already needs local code execution on the appliance. In the incidents the company has described, that first step was PHP2Shell against the Mobile Access Portal, a separate pair of flaws for which a fix had been available since 23 October. A gateway that was patched against PHP2Shell, or that did not expose that portal, is not automatically in the same position as one that was both unpatched and reachable. The KEV listing is about the local escalation being exploited in the wild, not about a new unauthenticated remote hole in every Gaia install.

The geography needs the same care. A reader who stops at the blog would take away “a couple of dozen” systems in “a single region.” A reader of the research report would take away a first wave against Israeli organisations, including some destructive activity, and a second, broader wave on 2 November across multiple countries with no destructive activity seen. Both documents are from Check Point, dated 12 November. The responsible way to use them is to keep those statements attached to the pages that made them, not to collapse them into a single, tidier statistic.

CISA’s addition of the flaw to the KEV catalogue, with a 16 November federal due date, shortens the clock for US federal agencies. It is a statement that the vulnerability is being exploited, and that agencies must follow the vendor’s mitigations by that date. It is not a finding about who the operators were. Check Point Research has already said it cannot make a high-confidence attribution. TSN recently reported another CISA KEV addition, for a Cisco BroadWorks flaw; that earlier listing is useful only as a reminder of how the catalogue works. It does not connect the two campaigns.

The practical next step for operators is the one Check Point and CISA both point to: install the listed Jumbo Hotfix takes where they apply, or, as an interim step, stop dynamic_server, knowing that this breaks the Dynamic CLI commands in sk144112, and investigate using the vendor’s own compromise indicators rather than guesswork about an unnamed actor.

Sources

1. CISA Known Exploited Vulnerabilities Catalog, CVE-2026-123039, date added 13 November 2026, due 16 November 2026
2. Check Point sk1000362, last modified 12 November 2026: CVE-2026-123039 — Local privilege escalation to root in the DynamicCLI process
3. Check Point Blog, Lotem Finkelstein, 12 November 2026: Security Advisory: Active Exploitation of PHP2Shell and Local Privilege Escalation
4. Check Point Research, 12 November 2026: PHP2Shell Exploitation on Check Point Gateway

Related stories

• 32 UK Government Services Offline After PHP2Shell, Minister Says is the nearest TSN account of earlier real-world PHP2Shell disruption, the same initial-access flaw Check Point says was chained with this Gaia privilege escalation.
• PHP2Shell: Honeypots Log 35 Confirmed RCEs, but No Victim Breach Yet
• CISA Adds Cisco BroadWorks XXE Flaw CVE-2026-20320 to KEV