If you manage Check Point gateways, check the Mobile Access Portal and what it can reach internally. Check Point saw attackers gain root on unpatched gateways and, in one investigated intrusion, reach a VMware ESXi host and run a wiper.
What changed on November 13, 2026
CISA added CVE-2026-123039 to KEV on November 13 and marked it for forensic triage. The federal deadline is November 16, 2026. Check Point published its advisory and incident findings on November 12 and confirmed exploitation beginning October 30. CISA previously added both initial-access PHP flaws, CVE-2026-109618 and CVE-2026-109619, on October 26.
Check your gateway and management builds
Check Point rates CVE-2026-123039 High, 7.8 CVSS v3.1. The DynamicCLI flaw requires local access and allows escalation to root. In the observed attacks, the internet-facing Mobile Access Portal supplied initial access through PHP2Shell. The vendor rates the PHP2Shell chain 9.2 and lists Quantum gateways from R80 through R82.20 plus specified Spark releases. Spark is outside the DynamicCLI advisory. For the affected Spark branches, Check Point directs customers to the latest GA firmware in the separate PHP guidance.
The vendor-authored CVE record lists these affected takes for Quantum Security Gateway and Quantum Security Management. Check Point’s November Jumbo release notes confirm the listed fixes for both the DynamicCLI flaw and PHP2Shell.
| Gaia release | Affected takes listed by CNA | First fix verified in release notes |
|---|---|---|
| R82.20 | 10 or earlier | Take 14 |
| R82.10 | 50 or earlier | Take 52 |
| R82 | 130 or earlier | Take 132 |
| R81.20 | 173 or earlier | Take 174 |
Check Point’s wider notice also names Management, Multi-Domain, Log Servers and Security Gateway across R80.30 through R82.20. Treat releases, roles or intervening takes absent from the table as requiring vendor confirmation. If patching must wait, Check Point documents disabling the DynamicCLI service where the resulting loss of functionality is acceptable. That temporary measure addresses local escalation only. Apply the PHP fix and investigate prior exposure separately.
Suggested MSP priority and response
- Treat exposed Mobile Access deployments as urgent. Inventory gateways, management and logging roles, Gaia versions and installed Jumbo takes per customer. Map gateway access to ESXi and other management networks.
- Preserve logs and isolate suspected appliances under your incident-response process. Review Check Point’s indicators and check downstream ESXi authentication and management activity. Patching alone cannot remove persistence from a compromised appliance.
- Apply the verified Jumbo hotfix for the branch or confirm a supported upgrade path. Verify the installed take, portal functionality, failover and logging. Where compromise is suspected, scope downstream access and rotate exposed credentials from a trusted system as part of recovery.
Official sources
- Check Point security advisory
- Check Point incident findings and indicators
- Check Point CNA record
- DynamicCLI advisory sk1000362
- PHP advisory sk1000302
- Check Point wider scope and workaround notice
- CISA KEV catalog data
- CISA federal forensic triage guidance
Last verified November 13, 2026.