Check Point confirms its Gaia zero-day was exploited at about two dozen customers
CISA added the privilege-escalation flaw to its exploited-vulnerabilities list on November 13, giving federal agencies until Monday, November 16 to patch. The flaw lets any local attacker run commands as root on Check Point security gateways.
📊 Scorecard: our Bearish call on $CHKP is scored from $147.18, the last close before it ran. Its first result comes after the next close.
The News
CISA, the US cybersecurity agency, added a Check Point flaw to its Known Exploited Vulnerabilities catalog on November 13. The flaw, tracked as CVE-2026-123039, is a privilege-escalation bug in Check Point's Gaia operating system — the software that runs on its security gateways, the boxes that sit at the edge of a corporate network and decide what traffic gets in. Check Point rates it 7.8 out of 10. Federal agencies must patch by Monday, November 16.
The bug sits in a piece of software called the DynamicCLI daemon, which runs with root privileges — the highest level of access on the system — and listens on a local socket, /tmp/dynamic_socket, that any process on the machine can write to (permissions 0777, meaning anyone can read and write it) without proving who it is. That means any attacker who already has a foothold on the gateway, even a low-privilege one, can send commands that run as root. Check Point says attackers did exactly that at about two dozen customers.
Reporting on the intrusions describes a chain: attackers first got in through two other flaws, CVE-2026-109618 and CVE-2026-109619, against Check Point's Mobile Access portals — the remote-access front door for employees working away from the office. Once inside, they used the DynamicCLI flaw to escalate to root, planted webshells — small hidden programs that let an attacker run commands through a web page — named zz*.tpl, installed a backdoor called TSGA that runs as /tmp/CPconfigdaemon, and then moved on to the victims' VMware ESXi servers over SSH, the standard remote-login protocol. In at least one intrusion they also ran a wiper, software designed to destroy data.
The affected Gaia branches are R82.20, R82.10, R82, R81.20, and the end-of-support R81.10 and R81. The fixes are R82.20 Take 14, R82.10 Take 52, R82 Take 132 and R81.20 Take 174. Check Point says its Spark Firewalls and Smart-1 Cloud products are not affected. The flaw needs an existing local foothold — on its own it is not a way for an outsider on the internet to break in unauthenticated.
The guard at the front door had a root flaw — and attackers already used it.
Why It Matters
Security gateways are the worst place to find a root flaw, because they guard the network's front door and see all of its traffic. A root flaw on a gateway hands an attacker the keys to the building: they can watch traffic, plant backdoors and move deeper into the network, as the moves onto ESXi servers in these intrusions show. The three-day federal deadline — Friday to Monday — tells you how seriously CISA takes it, and the fact that Check Point itself confirmed exploitation at about two dozen customers removes any doubt that this is theoretical.
The one piece of good news is the flaw needs a foothold first, so it is a second-stage weapon rather than a front-door key — but the Mobile Access entry flaws supplied that foothold. For the market, the question is how many gateways are still unpatched when Monday's deadline passes, and whether any of the exploited customers turns out to be a big name. A gateway vendor whose own product was the way in has a credibility problem to manage alongside the patching.
Analyst's Take
For Check Point, this is a credibility hit in the worst possible product line: the thing it sells is security, and its own gateways were the way in. The saving grace is that the company disclosed the exploitation itself and shipped fixes for every supported branch, which is how a vendor is supposed to handle this. The Bearish read is short-term: every exploited customer is a renewal conversation that just got harder, and every unpatched gateway is a live risk until Monday's deadline passes.
The longer question is whether the Mobile Access entry flaws and the DynamicCLI escalation point to a deeper design problem — a root daemon listening on a world-writable socket with no authentication is a design choice, not a typo. Watch whether Check Point says more about how that shipped, and whether any customer names a ransom demand. Reader poll: Are you patching Gaia this weekend? Vote: Patching now, Waiting for window, Switching vendors, or Not affected.
Are you bullish or bearish on this story?
By The Numbers
FAQ
What is the Check Point Gaia flaw?
CVE-2026-123039 is a privilege-escalation flaw in Check Point's Gaia operating system. A flaw in the DynamicCLI daemon, which runs as root and listens on a world-writable local socket without checking who is connecting, lets any locally running attacker submit commands that run as root.
How did attackers get in?
Reporting describes a chain: attackers first entered through two flaws, CVE-2026-109618 and CVE-2026-109619, against Check Point's Mobile Access portals, then used the DynamicCLI flaw to escalate to root, planted webshells and a backdoor called TSGA, and pivoted to VMware ESXi servers over SSH.
Which Check Point products are affected?
Gaia branches R82.20, R82.10, R82, R81.20, and the end-of-support R81.10 and R81. Fixes are R82.20 Take 14, R82.10 Take 52, R82 Take 132 and R81.20 Take 174. Spark Firewalls and Smart-1 Cloud are unaffected.
What should gateway owners do?
Patch before the federal deadline of Monday, November 16, and check for the reported signs of intrusion: zz*.tpl webshells, a TSGA backdoor running as /tmp/CPconfigdaemon, and unexpected SSH connections to ESXi servers.
👁
Source: GBHackers