CISA orders federal agencies to patch Check Point's exploited root-access flaw by Monday

CISA added Check Point's▲+0.01% — Check Point, up 0.01 percent today CVE-2026-123039 to its Known Exploited Vulnerabilities catalog↗ on November 13, its list of flaws confirmed in use in real attacks ¹. Federal agencies have until Monday, November 16, to patch ¹. The November Jumbo Hotfix is the first build that fixes both this root escalation and the PHP2Shell entry point behind it, and it stops short of two end-of-support releases that get no fix at all ²³. For Check Point investors, that gap is the story.

One open socket turned a portal break-in into root

The escalation is close to a one-request bug. Gaia, the operating system on Check Point appliances, runs its DynamicCLI daemon as root and has it listen on a local socket that affected releases created world-writable; the daemon executes whatever command arrives and never checks who sent it ².

The flaw is local-only, so the attackers needed a foothold first, and had one: PHP2Shell, two unauthenticated remote-code-execution flaws in PHP itself, which exposed the gateways' internet-facing Mobile Access portals ⁵⁴. Check Point shipped a portal hotfix on October 23↗; the first attacks came about a week later ³. The systems that were compromised had not installed it.

A contained count against a worldwide campaign

Check Point observed exploitation against "a couple of dozen customers," all unpatched ², and its advisory blog scopes those systems to a single region ³. The scanning was not regional. A first wave on October 30 hit Israeli organizations, some of them destructively; a second on November 2 reached organizations across multiple countries and sectors, planting backdoors without wiping anything ⁴. The compromise looks contained, the exposure was worldwide, and the R81 and R81.10 lines, now end-of-support, can only be migrated, never patched ².

The money moves to whoever decides who gets in

Root on the gateway handed the attackers a map of the network. The TSGA backdoor steals the gateway configuration↗, edits firewall logs and persists inside backups and snapshots; from there the attackers moved over SSH to VMware ESXi hosts and ran a wiper ⁴.

Every big edge vendor took a management-plane hit this year, Fortinet▼−1.13% — Fortinet, down 1.13 percent today, Cisco▼−7.54% — Cisco, down 7.54 percent today and Palo Alto Networks▲+1.74% — Palo Alto Networks, up 1.74 percent today included, and this is Check Point's third addition to CISA's catalog since July ⁶¹. The counsel buyers are getting is fewer doors: shrink the internet-facing edge and put remote access behind one identity policy ⁶.

AI puts more value behind the gateway

Check Point's growth pitch runs the other way, subscription firewalls and a Maestro orchestrator sized for AI data centers ⁷, marketed on a homepage running its PHP2Shell advisory↗ beside the AI Factory Firewall line ⁸. AI concentrates value behind these gateways and multiplies what asks to pass through them, and the security dollar follows the layer that decides who gets in.

The Jumbo Hotfix ends this incident. Migrating customers off releases no patch can reach is the harder work, and the better measure of the company.