Check Point has released emergency hotfixes because attackers have been exploiting unpatched Security Gateways, from R80 to R82.20, since late October to gain root. If your company uses Check Point firewalls or VPNs, directly or through your IT provider, install the November Jumbo Hotfix today and check whether you've already been compromised.
Key facts
- INCIBE published advisory INCIBE-2026-864 on 13 November, rated critical: 5 vulnerabilities, 2 critical, 2 high and 1 low.
- PHP2Shell (CVE-2026-109618 and CVE-2026-109619) are PHP memory flaws that could let an unauthenticated remote attacker execute code through a vulnerable web interface.
- CVE-2026-123039 (CVSS 7.8) is a missing authorization flaw in the DynamicCLI process: any authenticated local user can escalate to root, according to The Hacker News.
- Check Point Research observed attacks between 30 October and 4 November against unpatched gateways with the Mobile Access portal exposed to the internet.
- CISA added CVE-2026-123039 to its KEV catalog on 13 November. US federal agencies have until 16 November and must also carry out a forensic analysis.
Am I affected if I have a Check Point firewall?
Probably, if you haven't applied the November fixes. INCIBE says the issue affects Check Point Security Gateways, including Force Firewalls and Cloud Firewalls, from R80 to R82.20 with vulnerable web interfaces.
The CVE-2026-123039 escalation flaw affects R82.20, R82.10, R82, R81.20, R81.10 and R81 of Force Firewalls, Management and Log servers, Multi-Domain Security Management and Maestro Orchestrator.
Exposure depends on which services you have enabled and which fixes are installed. The highest-risk case is a Mobile Access portal open to the internet.
If you don't use Check Point, you're not affected. But many companies don't know which firewall they have because a provider manages it. Ask today.
How did they get in and what did they do next?
According to BleepingComputer, attackers got in through the Mobile Access portal using PHP2Shell and then escalated to root with CVE-2026-123039. Check Point says it saw active exploitation against a couple dozen customers. The Hacker News places the activity in late October against Israeli organisations, roughly a week after a patch was available.
With root, they installed the TSGA backdoor: encrypted remote access, configuration theft, persistence in backups and snapshots, process injection and tampering with the firewall's binary logs. In other words, it can alter the very records you would use to investigate.
In some intrusions they jumped from the gateway to a VMware ESXi host over SSH and ran a wiper, destroy_v6, which walks the target directory and deletes every file regardless of extension. Check Point doesn't have enough evidence to attribute the campaign to a specific group.
What to do today
- Ask your IT provider for the Gaia version and Jumbo Hotfix level of every Check Point firewall and management server.
- Install the November Jumbo Hotfix Accumulator. The fixed versions INCIBE lists are R82.20 Take 14, R82.10 Take 52, R82 Take 132 and R81.20 Take 174. Start with devices that expose Mobile Access to the internet.
- If you can't patch today, apply Check Point's mitigation: stop the dynamic_server process and prevent it from restarting. Consider closing external access to the portal.
- Check for compromise: web shells, unusual processes or files, and SSH connections from the gateway to ESXi. Rotate any credentials that may be exposed. Don't rely only on firewall logs, because TSGA can tamper with them.
- Make sure backups of your virtualised servers are isolated and not reachable from the firewall.
What it means for a small business
The firewall is the device you trust to protect you, and here it was the way in. That changes your priorities.
First, patching today is mandatory, but it isn't enough. Exploitation started a week after a patch existed. If your provider updates perimeter devices once a month, you've been exposed. For firewalls and VPNs, the patch window has to be measured in days.
Second, the jump from firewall to ESXi over SSH is a design problem, not a patching one. A gateway shouldn't be able to open sessions to your hypervisors or your backups. If another flaw appears tomorrow, that separation is what stops you losing your servers.
The documented attacks targeted Israeli organisations. That doesn't protect you: an unpatched gateway is just as vulnerable in Valencia as in Tel Aviv. If you're unsure who manages your perimeter or how to check for a possible compromise, an external cybersecurity team can help.
Frequently asked questions
Is installing the patch enough?
Not if your device was exposed since late October. The patch closes the door, but it doesn't remove anyone already inside. That's why CISA requires forensic analysis from federal agencies.
Am I safe if my Mobile Access portal isn't exposed?
Your risk is lower, not zero. INCIBE notes that exposure depends on enabled services, and CVE-2026-123039 gives root to any authenticated local user. Install the hotfix anyway.
Who is behind the attacks?
Unknown. Check Point doesn't have enough evidence to attribute them to a specific group.
Sources
- INCIBE-CERT: Múltiples vulnerabilidades en productos de Check Point (INCIBE-2026-864)
- BleepingComputer: Check Point warns of zero-day flaw exploited for root access
- The Hacker News: Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files
- CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog
- CISA: Known Exploited Vulnerabilities Catalog
