Check Point Firewall Owners: Install the November Jumbo Hotfix

If your office uses a Check Point Security Gateway or Spark firewall, especially with the Mobile Access portal turned on for remote workers, install Check Point's November Jumbo Hotfix. Check Point reported on November 12, 2026 that attackers broke into unpatched gateways by chaining two flaws, and on November 13 CISA added one of them, CVE-2026-123039, to its Known Exploited Vulnerabilities catalog.

The short version: install the November Jumbo Hotfix on every Check Point Management Server and Security Gateway, starting with any gateway whose Mobile Access portal can be reached from the internet.

What happened

According to Check Point, attackers first used PHP2Shell (CVE-2026-109618 and CVE-2026-109619), a PHP flaw that also affects Check Point gateways, to get in through the Mobile Access Portal without a password. Check Point scores it at CVSS 9.2. They then used a second flaw, CVE-2026-123039 (CVSS 7.8), in the Gaia OS DynamicCLI service to gain full root control of the gateway and stay on it.

Check Point says the activity ran from October 30 to November 4, that fixes for PHP2Shell had been available since October 23, and that only a couple of dozen unpatched systems in a single region were compromised. Affected customers were contacted directly. In many cases the attackers gained a foothold in the customer's network, and in a limited number of cases the attack also included destructive activity.

Who is at risk

• PHP2Shell (sk1000302): Security Gateways with the Mobile Access Portal, all versions from R80 to R82.20, plus Spark Firewalls on R81.10.x, R82.00.x, R77.20.x, and R80.20.x.
• CVE-2026-123039 (sk1000362): Gaia OS on R81.20, R82, R82.10, and R82.20.

The same advisory also lists two flaws not seen in attacks: CVE-2026-107484 in the Gaia Portal (CVSS 7.3) and CVE-2026-120490, a management-to-gateway access issue (CVSS 3.8). The November Jumbo Hotfix covers them as well.

What to do this week

1. Check the version. Note the exact version and Jumbo Hotfix take on each gateway and management server.
2. Install the November Jumbo Hotfix. Do internet-facing gateways with Mobile Access first, then the rest, including management servers.
3. Limit what faces the internet. If Mobile Access or the Gaia web portal does not need to be reachable from anywhere, restrict it to the people and networks that use it.
4. Look for signs of a break-in. Check Point's research post lists indicators, such as a process named like CPconfigdaemon, PHP session files containing upload_progress_pwn, unexpected scanner or wiper files under /tmp, and unexplained gaps in firewall logs. Check Point notes that finding no match does not rule out compromise.
5. If anything looks wrong, get help before wiping or rebuilding. Keep the logs; Check Point support can help with investigation.

Questions to ask your IT provider

1. Do all of our Check Point gateways and management servers have the November Jumbo Hotfix?
2. Is the Mobile Access portal turned on, and can it be reached from the public internet?
3. Have the gateways been checked for the indicators Check Point published?
4. Were the PHP2Shell hotfixes from October 23 installed, and when?