---
title: "CISA orders federal agencies to patch Check Point's exploited root-access flaw by Monday"
description: "The November 16 deadline arrives with the first build that fixes both the root escalation and the PHP2Shell entry point, and with two end-of-support releases that get no fix at all. For Check Point investors the question is whether \"a couple of dozen\" compromised systems in one region is containment, or the visible edge of a base that partly cannot be patched."
publisher: "The Inference"
section: "Security"
published: 2026-11-14T19:08:18.031Z
modified: 2026-11-14T19:08:18.031Z
canonical: https://theinference.org/article/cisa-orders-federal-agencies-to-patch-check-point-s-exploited-root-access-flaw-by-monday
language: en
keywords: "Cybersecurity, Vulnerabilities, Check Point Software, CISA, Firewalls"
---

# CISA orders federal agencies to patch Check Point's exploited root-access flaw by Monday

> The November 16 deadline arrives with the first build that fixes both the root escalation and the PHP2Shell entry point, and with two end-of-support releases that get no fix at all. For Check Point investors the question is whether "a couple of dozen" compromised systems in one region is containment, or the visible edge of a base that partly cannot be patched.

CISA added [Check Point](https://theinference.org/markets/companies/check-point-software)'s CVE-2026-123039 to its [Known Exploited Vulnerabilities catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) on November 13, its list of flaws confirmed in use in real attacks [1]. Federal agencies have until Monday, November 16, to patch [1]. The November Jumbo Hotfix is the first build that fixes both this root escalation and the PHP2Shell entry point behind it, and it stops short of two end-of-support releases that get no fix at all [2][3]. For Check Point investors, that gap is the story.

## One open socket turned a portal break-in into root

The escalation is close to a one-request bug. Gaia, the operating system on Check Point appliances, runs its DynamicCLI daemon as root and has it listen on a local socket that affected releases created world-writable; the daemon executes whatever command arrives and never checks who sent it [2].

The flaw is local-only, so the attackers needed a foothold first, and had one: [PHP2Shell, two unauthenticated remote-code-execution flaws in PHP itself](https://theinference.org/article/palo-alto-networks-has-no-pan-os-fix-for-php2shell-calls-it-9-2-and-sells-a-paid-virtual-patch), which exposed the gateways' internet-facing Mobile Access portals [5][4]. [Check Point shipped a portal hotfix on October 23](https://www.rescana.com/post/checkpoint-gaia-cve-2026-123039-kev-patch-now); the first attacks came about a week later [3]. The systems that were compromised had not installed it.

## A contained count against a worldwide campaign

Check Point observed exploitation against "a couple of dozen customers," all unpatched [2], and its advisory blog scopes those systems to a single region [3]. The scanning was not regional. A first wave on October 30 hit Israeli organizations, some of them destructively; a second on November 2 reached organizations across multiple countries and sectors, planting backdoors without wiping anything [4]. The compromise looks contained, the exposure was worldwide, and the R81 and R81.10 lines, now end-of-support, can only be migrated, never patched [2].

## The money moves to whoever decides who gets in

Root on the gateway handed the attackers a map of the network. The [TSGA backdoor steals the gateway configuration](https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/), edits firewall logs and persists inside backups and snapshots; from there the attackers moved over SSH to VMware ESXi hosts and ran a wiper [4].

Every big edge vendor [took a management-plane hit this year](https://theinference.org/article/attackers-sat-inside-check-point-s-firewall-brain-for-two-months-the-stock-went-up), [Fortinet](https://theinference.org/markets/companies/fortinet), [Cisco](https://theinference.org/markets/companies/cisco) and [Palo Alto Networks](https://theinference.org/markets/companies/palo-alto-networks) included, and this is Check Point's third addition to CISA's catalog since July [6][1]. The counsel buyers are getting is fewer doors: shrink the internet-facing edge and put remote access behind one identity policy [6].

## AI puts more value behind the gateway

Check Point's growth pitch runs the other way, [subscription firewalls](https://theinference.org/article/check-point-rents-its-firewall-monthly-from-november-1-and-reports-earnings-november-2) and a Maestro orchestrator sized for AI data centers [7], marketed on a homepage running [its PHP2Shell advisory](https://www.checkpoint.com/) beside the AI Factory Firewall line [8]. AI concentrates value behind these gateways and multiplies what asks to pass through them, and the security dollar follows the layer that decides who gets in.

*Chart: **Check Point's revenue growth slid to its first decline in Q3 '26** Line chart of Check Point Software's quarterly revenue growth, year over year, from late 2023 through the third quarter of 2026; growth holds near 6 percent, then slows to 1.3 percent in the second quarter of 2026 and turns negative at minus 1.1 percent in the third.*

*Year-over-year change in Check Point's quarterly revenue, Q4 2023 through Q3 2026, computed from the figures in its SEC filings. The third quarter, which ended September 30, is the first negative quarter in the run; it closed four weeks before the first PHP2Shell attacks. [9]*

The Jumbo Hotfix ends this incident. Migrating customers off releases no patch can reach is the harder work, and the better measure of the company.

## Takeaway

Monday's deadline closes the root escalation and the PHP2Shell entry point on supported releases, but Check Point's end-of-support R81 and R81.10 gateways can only be migrated, and how many of those sit in the installed base is the question the company has not answered.

## Sources

1. [CISA, Known Exploited Vulnerabilities catalog feed (catalog version 2026.11.13), released 13 November 2026](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
2. [Check Point, sk1000362: CVE-2026-123039 local privilege escalation to root in the DynamicCLI process, last modified 12 November 2026](https://support.checkpoint.com/results/sk/sk1000362)
3. [Rescana, Check Point Gaia CVE-2026-123039: Exploited DynamicCLI Root Escalation Added to CISA KEV, 14 November 2026](https://www.rescana.com/post/checkpoint-gaia-cve-2026-123039-kev-patch-now)
4. [Check Point Research, PHP2Shell Exploitation on Check Point Gateway, 12 November 2026](https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/)
5. [BleepingComputer, Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiper, 13 November 2026](https://www.bleepingcomputer.com/news/security/check-point-gateways-hacked-via-php2shell-to-deploy-vmware-esxi-wiper/)
6. [CSO Online, The firewall becomes the foothold: Attackers turn Check Point gateways against customers, November 2026](https://www.csoonline.com/article/4248693/the-firewall-becomes-the-foothold-attackers-turn-check-point-gateways-against-customers.html)
7. [CRN, Check Point's Firewall Subscription, Maestro Expansion Tackle 'Important' AI-Era Demands, November 2026](https://www.crn.com/news/security/2026/check-point-s-firewall-subscription-maestro-expansion-tackle-important-ai-era-demands-partner-exec)
8. [Check Point homepage, PHP2Shell exposure advisory banner and AI Factory Firewall marketing, accessed 14 November 2026](https://www.checkpoint.com/)
9. [Check Point Software, quarterly figures from its SEC filings, retrieved 14 November 2026](https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001015922)


---

CISA orders federal agencies to patch Check Point's exploited root-access flaw by Monday — The Inference. Canonical: https://theinference.org/article/cisa-orders-federal-agencies-to-patch-check-point-s-exploited-root-access-flaw-by-monday