How to Clear the Check Point KEV Deadline by November 16

Security and network teams can use this Check Point KEV checklist to prove the November Jumbo Hotfix landed, confirm Gaia socket permissions, and hunt post-exploitation before the November 16, 2026 federal due date. CISA’s November 13 alert added CVE-2026-123039 after a Mobile Access chain gave attackers root on a couple of dozen customers. Rescana lists a U.S. federal civilian due date of November 16, 2026, and BOD 26-04 expects agencies to check for compromise before the patch.

Updated November 14, 2026

What should you inventory first?

Check Point’s advisory says to install the November Jumbo Hotfix on all Management Servers and Security Gateways, and to prioritize internet-facing Mobile Access. Rescana’s summary of sk1000362 lists Gaia R82.20, R82.10, R82, R81.20, R81.10, and R81. Spark Firewalls and Smart-1 Cloud are not affected. Upgrade end-of-support R81.10 and R81, with the mitigation in place until that upgrade lands.

• Security Gateway and Firewall, including Force Firewalls
• Security Management Server, Log Servers, and Multi-Domain Security Management
• Maestro Orchestrator and Scalable Platforms
• Mobile Access portals exposed since late October

How do you prove the Check Point KEV hotfix landed?

The CVE-2026-123039 fix ships in the November Jumbo Hotfix. The same Takes include the PHP2Shell fix in sk1000302 and the fix for CVE-2026-107484. Check Point scores those flaws at 7.8, 9.2, and 7.3. CVE-2026-107484 is not exploited and is not in the KEV catalog.

1. Install the November Jumbo Hotfix on every in-scope Management Server and Security Gateway, starting with internet-facing Mobile Access.
2. If a supplier runs the system, ask for the Take number, install date, Gaia version, and when sk1000302 was installed.
3. After patching, confirm ls -l /tmp/dynamic_socket shows srw-rw—- root config (0660), not srwxrwxrwx (0777).
4. If you cannot patch before November 16, stop dynamic_server and prevent restart with dbset process:dynamic_server followed by dbset :save. Follow sk1000362 exactly. That causes the Dynamic CLI commands listed in sk144112 to fail.

What should you hunt before you call a gateway clean?

Exploitation ran from October 30 through November 4, after a PHP2Shell hotfix had been available since October 23. Check Point says only a couple of dozen unpatched systems, in a single region, were compromised in the incidents it observed. Attackers used PHP2Shell on the Mobile Access portal, then CVE-2026-123039 to reach root.

Check Point Research describes PHP webshells and TSGA with TSProxy. In the investigated intrusion, attackers reached VMware ESXi over SSH and ran destroy_v6; the company’s blog says destructive activity happened in a limited number of cases. Check Point Research, as summarized by Rescana, says the evidence “does not allow us to assess with high confidence the true nature of this operation.”

If a gateway was exposed and unpatched from late October into early November, review /var/log/dynamicCli.log before you trust the Take. Commands that skip the expected Clish wrapper may indicate root execution through the socket. On patched systems, “Rejected connection from unauthorized uid” indicates that an escalation attempt was blocked.

• PHP session files containing the string upload_progress_pwn
• A process or binary using the CPconfigdaemon naming pattern
• Scanner or wiper tooling under /tmp or /temp
• A note referencing “Dream Annexation” with no payment demand
• Scanning from 130.94.19[.]204 or 130.94.19[.]168
• Unexplained firewall-log gaps after a logging-daemon crash

Absence of a match does not rule out compromise, and presence of a match warrants immediate investigation.

That limit is Check Point’s. Frank Dickson, via CSO Online, advised turning off unused Mobile Access, keeping management interfaces off the internet, cutting any trusted path into VMware ESXi, and shipping logs off-box as they happen. CSO Online also reported login-template webshells and messages signed Dream Security Ltd.

CSO Online reported that patches do not evict already established attackers, so teams must investigate and, where necessary, rebuild affected systems from trusted images. The same failure mode is why a patched console can still be rooted.

What should non-federal teams still finish by November 16?

BOD 26-04 applies only to Federal Civilian Executive Branch agencies. CISA still urges all organizations to prioritize KEV remediation. Rescana lists known ransomware use as Unknown. For security managers, install time is not the close of the ticket: the catalog addition is a reason to prove the Take and hunt the window from late October through early November.

Dickson told CSO Online that “The management plane holds the rulebook for the entire network.” Ask suppliers for the Gaia version, the November Take and date, whether Mobile Access was internet-facing in late October, and what dynamicCli.log showed. Hold incomplete answers open, including when CISA adds an edge product to the KEV catalog.