CVE-2026-123039 in Check Point Gaia lets an attacker with limited device access escalate to root. Intrusions start at the Mobile Access portal and end with planted backdoors.
Check Point has patched an actively exploited privilege escalation flaw in Gaia, the operating system running on its firewalls and management servers. Tracked as CVE-2026-123039, the flaw lets attackers gain root on the appliance and leave persistent backdoors behind.
What happened
The flaw sits in the root-owned component that serves Gaia's Dynamic CLI interface. That component accepts commands from any program on the device without verifying who sent them, so an attacker with limited access to the appliance can have their commands executed as root. ITdaily reports the issue as scoring CVSS 7.8.
This is not a standalone remote exploit: the attacker first needs code execution on the device by some other route. In the intrusions tracked by Check Point Research, that route was the Mobile Access portal on unpatched Security Gateways. Once inside, attackers used the flaw to gain root and plant backdoors; in some cases they also wiped files on VMware ESXi servers. A first wave hit on 30 October 2026 and a second on 2 November 2026, affecting organisations across several countries and sectors.
Why it matters
Affected products include Force firewalls, management and log servers, Multi-Domain Security Management, Multi-Domain Log Server and Maestro Orchestrator, on versions R82.20, R82.10, R82, R81.20, R81.10 and R81. Spark firewalls and Smart-1 Cloud are not affected.
Fixes ship as Jumbo Hotfix Accumulators: Take 14 for R82.20, Take 52 for R82.10, Take 132 for R82 and Take 174 for R81.20. One detail deserves attention: R81.10 and R81 have reached end of support, so no patch was issued for them. The US cybersecurity agency CISA added the flaw to its Known Exploited Vulnerabilities catalog on 13 November 2026.
What this means for businesses in Türkiye
Enterprise firewalls in Türkiye are commonly installed once and then left on the same firmware for years. Jumbo Hotfix packages do not apply themselves; someone has to plan a maintenance window for them. Appliances running end-of-support versions cannot be patched at all, which turns the question into a version or hardware upgrade rather than a patch.
The most important point about this campaign is that patching alone does not close the story. If an attacker already got in and planted a backdoor, the update does not remove it. Where unauthorised access to systems holding personal data is identified, Turkish data protection law (Law No. 6698) requires notifying the Authority within 72 hours.
What we recommend at Kamer Bilişim
- Check your firewall version and Jumbo Take level. If you run Check Point, confirm the current build from the management interface and apply the relevant Jumbo Hotfix in a planned maintenance window. If immediate patching is not possible, the component behind the Dynamic CLI can be disabled temporarily, at the cost of some additional commands no longer working.
- Hunt for compromise after patching. The Dynamic CLI log records the commands sent to the component; commands that create users or download files are worth investigating. Check Point Research has published attacker IP addresses, file names and hashes that can be used to search your logs.
- Retire end-of-support appliances. Versions such as R81.10 and R81 will not receive fixes, leaving them exposed to every new flaw. Under a managed maintenance agreement we keep your device version inventory and track vendor advisories and the CISA KEV catalog on your behalf.
If you are unsure whether your firewall is current, we will review your setup with you. We provide on-site support across the Anatolian side of Istanbul and remote support elsewhere. Reach us through our contact page.
Source: ITdaily, CISA Known Exploited Vulnerabilities Catalog, Check Point Research
Source: ITdaily