Check Point has patched a vulnerability in Gaia, the operating system of its firewalls and management servers.
Attackers are exploiting a flaw in the Gaia operating software of Check Point firewalls and management servers. The bug allows attackers to take full control of devices. Check Point is releasing a patch.
The vulnerability is tracked as CVE-2026-123039. Check Point gives it a CVSS score of 7.8, which is considered high. The patch is included in the Jumbo Hotfix Accumulators for R82.20 (from Take 14), R82.10 (from Take 52), R82 (from Take 132) and R81.20 (from Take 174).
Bug in Gaia
Gaia has an extensive command line, the Dynamic CLI. The component that processes those commands runs as root, the account with the highest privileges on the device. It accepts commands from any program on the device, without checking who sends them, and executes them as root.
An attacker who has gained access to the device with limited privileges can thus have any command executed. To do so, they must first be able to run code on the device by other means.
In the attacks already carried out that Check Point Research describes, the attackers got in via the Mobile Access portal of unpatched Check Point Security Gateways, using exploitation consistent with PHP2Shell.
Using CVE-2026-123039, they then gained root access and planted backdoors. A first wave of attacks from 30 October hit Israeli organisations, with the attackers in some cases also wiping files on VMware ESXi servers. A second wave on 2 November hit organisations in several countries and sectors.
Affected devices
The flaw affects Check Point Force Firewalls, Management Servers and Log Servers, Multi-Domain Security Management, Multi-Domain Log Server and Maestro Orchestrator. It concerns versions R82.20, R82.10, R82, R81.20, R81.10 and R81. Spark Firewalls and Smart-1 Cloud are not affected. For R81.10 and R81, which no longer receive support, Check Point mentions no patch.
Updating and checking
Administrators should install the Jumbo Hotfix for their version. If that is not possible straight away, they can temporarily disable the component behind the Dynamic CLI. Some of the extra commands in the command line will then stop working. After the update, administrators can check with a single command whether the patch is active.
A patch does not remove a backdoor that is already in place. The Dynamic CLI log file shows which commands were received. According to Check Point, commands to create users or download files are grounds for further investigation. Check Point Research also published the attackers’ IP addresses, file names and hashes, which organisations can use to check whether their devices are infected.