Check Point Firewall Flaw Is Already Being Used in Attacks, US Cyber Agency Says
The U.S. Cybersecurity and Infrastructure Security Agency added a flaw in Check Point security products to its Known Exploited Vulnerabilities Catalog on Nov. 13, 2026, on evidence that it is already being used in attacks. The flaw, CVE-2026-123039, lets a user who already has an ordinary account on one of the appliances take complete control of the device.
CISA's alert names the affected products as Check Point Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway and Security Management Server, and classes the problem as an incorrect permission assignment for a critical resource. Check Point's own CVE record lists the affected builds as R82.20 with Jumbo Hotfix Take 10 or below, R82.10 with Take 50 or below, R82 with Take 130 or below and R81.20 with Take 173 or below, and sends administrators to its advisory, sk1000362, for the fix. That advisory describes the flaw as a local escalation to root, the top-level account on Gaia, the operating system Check Point's appliances run.
The listing also sets a clock. CISA gave federal civilian agencies until Nov. 16, 2026, to act, under Binding Operational Directive 26-04, which requires them to prioritize catalog flaws on publicly exposed systems that give an attacker total control of the system after exploitation. The agency added that it encourages all other organizations to work from the same list.
Check Point, which issued the CVE record itself, scores the flaw 7.8 out of 10 on the CVSS scale, high rather than critical. Both that score and CISA's description put the flaw out of reach over the network: it needs a user who already has an account on the appliance.
The same alert added one other flaw to the catalog, CVE-2026-114713 in the open-source chat server UnrealIRCd, with the same deadline of Nov. 16, 2026.
