Check Point firewall zero-day exploited: what to check now
A Check Point flaw that gives attackers root on gateways has been exploited since late October. CISA listed it on November 13. What small offices should do.
If your office firewall is a Check Point gateway, it needs attention this week. On November 13, 2026, Check Point warned that attackers have been exploiting a previously unknown flaw to take full control of some of its gateways and management servers, and CISA added the flaw to its list of known exploited vulnerabilities the same day. Many small businesses have a Check Point appliance that an IT provider installed years ago and nobody has logged in to since. Here is what happened and what to check.
What happened
The flaw is tracked as CVE-2026-123039. According to BleepingComputer, it sits in a background service on Check Point's Gaia operating system that accepts commands through a local socket without checking who is connecting. Someone who already has a foothold on the device can use it to run commands as root, the highest level of control. Check Point says the flaw has been exploited since late October against what it described as a couple of dozen customers. Affected products include Security Gateway, Security Management Server, Multi-Domain Security Management Server and Scalable Platforms.
The flaw on its own needs local access, so attackers paired it with another way in. Network World reports that they first broke into the Mobile Access portal, the remote access login page some gateways expose to the internet, using two critical PHP flaws known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Once they had root, they hid web shells in the portal's login pages, installed backdoor malware that survives reboots, moved from the firewall to a VMware ESXi server on the internal network and, in at least some cases, ran software designed to destroy data.
The CISA alert of November 13 lists the flaw as an incorrect permission assignment in multiple Check Point products and urges all organizations, not only federal agencies, to prioritize it.
Why it matters for a small office
A firewall sits between the internet and everything else you own. When it is the device that gets compromised, the usual protections on your computers see traffic that appears to come from a trusted place. The attack chain above also shows a pattern that has repeated across many firewall brands this year: a remote access portal exposed to the internet, a flaw in it, and a quick move inward to servers and backups.
What to do now
- Find out what your firewall is. Check the label on the box or ask your IT provider for the make, model and software version. If it is Check Point, continue below.
- Apply Check Point's hotfix. Check Point has released emergency hotfixes, described in its advisory sk1000362. Devices with the Mobile Access portal reachable from the internet should be first.
- If you cannot patch today, Check Point's interim workaround is to stop the dynamic_server process and prevent it from restarting. Your provider should do this, as it can affect some command-line functions.
- Turn off what you do not use. If nobody connects through Mobile Access, disable it. Keep the firewall's management interface off the public internet.
- Look for signs of compromise. Ask whoever manages the device to run the log checks Check Point published for gateways that have been exposed since late October. If anything looks wrong, treat the firewall and anything behind it as suspect and plan a rebuild from trusted images.
- Protect your backups and virtual servers. The firewall should have no trusted path into your VMware hosts or backup systems, and at least one backup copy should be offline or immutable.
How we can help
If you are not sure what protects your network, our network setup and management team can check your firewall, apply updates and close remote access you do not need. For a wider review, see our cybersecurity services, or read our earlier note on when an office outgrows its router. Call (213) 986-4855.