CISA adds exploited Check Point and UnrealIRCd flaws to KEV
Federal agencies must fix both entries by November 16; Check Point intrusions used PHP2Shell, then a root bug, webshells, and a wiper.
82
Product
Gaia OS
- Mentions · 7d8
- Mentions · 30d8
- All mentions8
- First seenNov 13, 2026
- Last mentioned4h ago
Timeline
8 articles · newest firstCISA adds exploited Check Point Gaia root flaw to KEV catalog
CVE-2026-123039 escalates a local Gaia user to root through an unauthenticated DynamicCLI socket; the KEV deadline is November 16.
78
CISA lists exploited Check Point Gaia flaw that yields root
Check Point says it saw exploitation at about two dozen customers; fixes start at named Jumbo Hotfix takes, with R81 and R81.10 unsupported.
78
Attackers exploit Check Point gateways for root and ESXi wipes
PHP2Shell gave unauthenticated portal access, then a local bug yielded root, persistence and a wiper.
84
Check Point patches exploited Gaia OS flaw granting root (CVE-2026-123039)
Check Point says a couple of dozen customers were hit since late October, with webshells, backdoors, and an ESXi wiper following.
84
Check Point PHP2Shell flaws exploited for root and ESXi wiper
CVE-2026-123039 on Gaia OS R81 through R82.20 followed PHP2Shell entry; named Jumbo Hotfix Takes are the fixes.
84
Attackers exploit Check Point gateway flaws to deploy TSGA and wipe ESXi
Activity began October 30 against Israeli organizations, then widened November 2, using CVE-2026-123039 after PHP2Shell access.
86
CISA lists Check Point local root flaw as exploited (CVE-2026-123039)
Gaia DynamicCLI accepts unauthenticated local commands as root; the federal due date is November 16, 2026.
76
Related CVEs
by mentions- CVE-2026-1230391%7.8Local root command execution via Gaia OS DynamicCLI socket
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-114713<1%8.6Label tag injection in UnrealIRCd before 6.2.7.1
Appears with
- Check Pointvendor · 8
- TSGAmalware · 6
- TSProxymalware · 5
- Mobile Accessproduct · 4
- Security Gatewayproduct · 4
- CISAorganization · 4
- destroy_v6malware · 4
- PhiliKitmalware · 3
- VMware ESXiproduct · 3
- VMwarevendor · 2
- Check Point Firewallproduct · 2
- Security Management Serverproduct · 2
- UNC5221threat actor · 2
- Scalable Platformsproduct · 1
- Maestro Orchestratorproduct · 1
- Check Point Security Gatewaysproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.