CVE-2026-123039: How PHP2Shell Became Root on Check Point Gateways, and How to Close It

Vulnerability briefing · 13 November 2026 · By the Rokkhe research team

CVE-2026-123039 is a high-severity (CVSS 7.8) privilege escalation in the DynamicCLI service of Check Point Gaia OS. On 12 November 2026, Check Point confirmed that attackers chained it with PHP2Shell in the Mobile Access portal to gain root on unpatched gateways. Install the November Jumbo Hotfix, then hunt for the published indicators.

TL;DR

• What: a root process on Gaia (dynamic_server) accepts commands from a world-writable local socket without checking who is connecting. Anyone already running code on the box can become root.
• How it was used: PHP2Shell (CVE-2026-109618 / CVE-2026-109619) gave the attacker code execution through the Mobile Access portal. CVE-2026-123039 turned that into root.
• Who: Check Point Force Firewalls, Management and Log Servers, Multi-Domain servers and Maestro Orchestrator on R81 to R82.20. Spark Firewalls and Smart-1 Cloud are not affected by CVE-2026-123039.
• Exploited? Yes. Check Point saw the chain used against "a couple of dozen" unpatched systems between 30 October and 4 November 2026.
• Fix: November Jumbo Hotfix: R82.20 Take 14, R82.10 Take 52, R82 Take 132 or R81.20 Take 174 or later.
• Then: patching closes the door, but it does not remove an attacker who is already inside. Hunt before you call it done.

What is CVE-2026-123039?

Gaia's dynamic (extended) CLI is served by a root process called dynamic_server. It listens on a local socket at /tmp/dynamic_socket. According to Check Point's advisory (sk1000362), on affected versions that socket is created world-writable (0777), the connecting process is not authenticated, and the daemon runs whatever command string it receives as root.

On its own, this is a local bug: CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N, score 7.8. An attacker first needs to run code on the appliance. That is exactly what PHP2Shell provides.

Why this one matters most this week

We weighed everything disclosed or newly exploited from 11 to 13 November, including a critical Apache HTTP Server mod_http2 bug (CVE-2026-119618) and a large Citrix NetScaler patch set. Neither had confirmed in-the-wild exploitation when we checked. This chain does. It hits the security gateway itself, the device that sits at the edge of the network and holds VPN access and the firewall policy. In some of the incidents the attackers also reached a hypervisor.

Who is affected?

CVE-2026-123039 (local privilege escalation, sk1000362):

• Products: Check Point Force Firewalls; Management and Log Servers; Multi-Domain Security Management and Multi-Domain Log Server; Maestro Orchestrator.
• Affected versions: R82.20, R82.10, R82, R81.20, plus R81.10 and R81 (both end of support).
• Not affected: Check Point Spark Firewalls and Smart-1 Cloud.

PHP2Shell on Check Point (remote code execution, sk1000302). This applies to firewalls that use any of these features:

• Mobile Access Portal
• Remote Access VPN with SSL Network Extender
• Remote Access VPN with SAML realm authentication
• Identity Awareness Captive Portal
• UserCheck Portal
• Zero Phishing

Affected versions are R81.20 to R82.20, older end-of-support releases from R80, and Spark R81.10.x and R82.00.x. Security Management and Log Servers are not affected by PHP2Shell.

Fixed versions (both issues):

• R82.20: Jumbo Hotfix Take 14 or later
• R82.10: Jumbo Hotfix Take 52 or later
• R82: Jumbo Hotfix Take 132 or later
• R81.20: Jumbo Hotfix Take 174 or later
• Spark R82.00.11: build B998002843 or later
• Spark R81.10.17: build B996005005 or later

How the attack works

This is how Check Point Research described the intrusions, in plain terms:

1. Entry. The attacker reached an internet-facing Mobile Access portal on a gateway that did not have the 23 October PHP2Shell hotfix.
2. Code execution. PHP2Shell, a use-after-free class of flaws in PHP request handling, gave them code execution as the portal's service account. Check Point found PHP session files containing the marker upload_progress_pwn, and hundreds of crashes in the portal's web workers.
3. Root. The attacker wrote a command to the DynamicCLI socket (CVE-2026-123039), and it ran as root.
4. Persistence and pivot. They planted PHP webshells as zz*.tpl templates in the portal, and a backdoor disguised as CPconfigdaemon that later runs as slot_CPconfigdaemon and drops /lib/libcpfwcommon.so. They scanned the internal network, moved over SSH to a VMware ESXi host using the vpxuser account, and in a limited number of cases ran a wiper.

Check Point says a first wave on 30 October focused on organisations in one region (Israel). A second wave on 2 November scanned organisations in several countries, with no evidence of destructive activity. Check Point also says the evidence does not support a high-confidence attribution.

How to check if you're affected

Run these on every gateway, cluster member and management server. Use Expert mode unless noted. All of them only read; none changes anything.

• Version and Jumbo take: run show version all in clish, or cpinfo -y all in Expert mode and read the JUMBO_HF_MAIN take. Compare it with the fixed takes above.
• Exposure to PHP2Shell: enabled_blades lists the active blades. Look for Mobile Access and Identity Awareness, then check in SmartConsole which portals face the internet.
• The vulnerable socket: ls -l /tmp/dynamic_socket. A world-writable socket (srwxrwxrwx) on an unpatched take matches the advisory's description.
• After patching: grep "Rejected connection from unauthorized uid" /var/log/dynamicCli.log. The fix blocks and logs unauthenticated calls, so hits here are worth a closer look.

How to fix it

1. Install the November Jumbo Hotfix on all Management Servers and Security Gateways, starting with gateways that expose Mobile Access. The takes are listed above.
2. If you cannot patch PHP2Shell today, apply the cp-httpd.conf mitigation in sk1000302 and restart the portals. Check Point also offers a standalone PHP2Shell hotfix, which needs a reboot. R82.20 gateways are protected by the IPS signature "PHP Remote Code Execution", even when IPS is not enabled.
3. If you cannot patch CVE-2026-123039 today, follow the sk1000362 mitigation, which stops the dynamic_server process and keeps it from restarting. This breaks the Dynamic CLI commands listed in sk144112.
4. Retest from the outside. Confirm the portals respond as expected and the take is correct on every cluster member, not just the active one.

Detection and hunting

Check Point notes that no match does not rule out compromise. On the other hand, any match calls for immediate investigation.

On the appliance (read-only):

• grep -rl upload_progress_pwn /opt/CPcvpn-*/tmp/ 2>/dev/null finds PHP session artefacts from the exploit.
• find / -xdev \( -name 'zz*.tpl' -o -name '.up.tpl' \) 2>/dev/null finds the webshell templates.
• ls -la /tmp/CPconfigdaemon /tmp/.bd.log /tmp/.p_sock /lib/libcpfwcommon.so 2>/dev/null checks for backdoor files.
• ps -ef | grep -i '[C]Pconfigdaemon' and netstat -tlnp | grep ':11072' check for the backdoor process and its listener.
• Check SHA-256 hashes of anything suspicious against the IOC table in Check Point Research's report.

In your SIEM:

• Splunk: index=* ("130.94.19.204" OR "130.94.19.168")
• Microsoft Sentinel: CommonSecurityLog | where SourceIP in ("130.94.19.204","130.94.19.168") or DestinationIP in ("130.94.19.204","130.94.19.168")
• SSH logins to ESXi hosts as vpxuser that come from a gateway address.
• Gaps in firewall traffic logs, especially after the logging daemon crashes.

If you find a match, treat the gateway as compromised. Bring in Check Point support and your incident-response process, preserve evidence, and rotate the credentials that pass through or are stored on the gateway.

Severity, KEV and EPSS

• CVE-2026-123039: CVSS 3.1 7.8 (High), assigned by Check Point as the CNA. NVD analysis is pending. Check Point and the Canadian Centre for Cyber Security (AV26-1154) report it as exploited in the wild. It was not yet in CISA's KEV catalog when we checked on 13 November (catalog version 2026.11.10), and FIRST has not yet published an EPSS score for it.
• PHP2Shell (CVE-2026-109618 / CVE-2026-109619): CVSS 9.2 (Critical). It has been in CISA KEV since 26 October 2026, with a federal due date of 29 October. Its EPSS score on 12 November was 0.99999, the top of the scale.

FAQ

What is CVE-2026-123039?
It is a local privilege escalation in Check Point Gaia OS. The root dynamic_server process accepts commands from a world-writable socket without authentication, so anyone already running code on the appliance can become root. CVSS 7.8.

Is CVE-2026-123039 being exploited?
Yes. Check Point confirmed exploitation, chained with PHP2Shell, against a couple of dozen unpatched systems between 30 October and 4 November 2026.

Which Check Point versions fix it?
The November Jumbo Hotfix fixes it: R82.20 Take 14, R82.10 Take 52, R82 Take 132 and R81.20 Take 174 or later. R81 and R81.10 are end of support, so plan an upgrade.

My gateway doesn't use Mobile Access. Am I safe?
You are less exposed, but not safe. PHP2Shell also reaches gateways through SSL Network Extender, SAML VPN, Captive Portal, UserCheck and Zero Phishing. CVE-2026-123039 also affects management servers. Patch everything.

I patched. Am I done?
Not yet. Patching stops new break-ins. Hunting for the indicators above shows whether someone got in before you patched.

References

• Check Point Blog: Security Advisory: Active Exploitation of PHP2Shell and Local Privilege Escalation (12 Nov 2026)
• Check Point Research: PHP2Shell Exploitation on Check Point Gateway (12 Nov 2026)
• Check Point sk1000362: CVE-2026-123039
• Check Point sk1000302: PHP2Shell response
• NVD: CVE-2026-123039
• Canadian Centre for Cyber Security AV26-1154
• CISA Known Exploited Vulnerabilities catalog
• PHP security advisory GHSA-6wmf-4rv5-p3rp
• FIRST EPSS
• cve.now

From "patched" to "proven"

Attackers struck about a week after the fix shipped, and they chained two bugs: one at the edge, one on the box. Most teams found out about the second one only this week. That gap is the job.

This briefing was written by the Rokkhe research team. Rokkhe is an AI pentesting and security-operations workspace. Learn more at rokkhe.com.