Vendors and CVEs › CVEs › CVE-2026-123039
CVE-2026-123039: what it is, who is affected and what to do
BleepingComputer reports Check Point has released emergency hotfixes for a high-severity flaw. Attackers have exploited it since late October to gain root privileges and set up persistence on vulnerable devices.
- Known exploited. Not on CISA’s list when reported.
- CVSS. 7.8, as the source states.
- Records. CVE-2026-123039 on the National Vulnerability Database · CISA’s known exploited catalog
The stories
Critical Known exploited
Check Point releases emergency fixes for gateway flaw already exploited
BleepingComputer reports Check Point has released emergency hotfixes for a high-severity flaw. Attackers have exploited it since late October to gain root privileges and set up persistence on vulnerable devices.
Critical Known exploited
CISA lists new Check Point flaw as exploited, plus an UnrealIRCd flaw
CISA added CVE-2026-123039, a Check Point multiple-products permissions flaw, and CVE-2026-114713, an UnrealIRCd flaw, to its Known Exploited Vulnerabilities Catalog. It cites evidence of active exploitation for both.
High
Attackers broke into Check Point gateways, then wiped a VMware server
Check Point Research describes attacks from 30 October 2026 on unpatched Security Gateways using Mobile Access portals.