Check Point said in an advisory that attackers used a flaw in its Gaia operating system to run commands as root, the top level of control. The company saw it used against a couple of dozen customers. The flaw is CVE-2026-123039, with a CVSS severity score of 7.8. BleepingComputer reported that attacks began in late October and that Check Point has now shipped emergency fixes.
An attacker needs a local login on the device first. Check Point lists its Force Firewalls, Management and Log Servers, Multi-Domain products and Maestro Orchestrator as affected. It lists fixes for R82.20, R82.10, R82 and R81.20. It names no fix for R81.10 or R81, which are also affected. BleepingComputer, citing a separate Check Point report, said attackers entered through the Mobile Access portal, gained root, then moved to a VMware ESXi host and ran wiper malware. The attackers are not named.
In that reported chain, a device meant to guard the network became the way in. Buyers can ask three things. Which of our devices run R81.10 or R81, where no fix is named? Who holds local logins on them? Who reviews their logs?