CVE-2026-107484 in checkpoint quantum security gateway
Exploitation of this CVE does not show up in logs, so there is no detection rule for it.
What the vulnerability is
An input and authorization validation vulnerability in Gaia Portal backend handlers could allow an authenticated, non-administrative user to perform privileged operations that should be restricted to administrators.
Affected software: checkpoint quantum security gateway, checkpoint quantum security management
Scores
- CVSS: 7.3 (high)
- EPSS: 1.87% chance of exploitation in the next 30 days
- CISA KEV: Not listed
- Published: 2026-11-12
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Apply the Check Point Gaia hotfixes for DynamicCLI and Gaia Portal (sk1000362, sk1000291)
Patch or upgrade. Two Gaia OS flaws let an authenticated non-admin user run commands as root through the DynamicCLI socket or do admin-only actions in Gaia Portal. Check Point reports active exploitation of the DynamicCLI flaw (CVE-2026-123039) since late October, chained with PHP2Shell through the Mobile Access portal and followed by a wiper on VMware ESXi, so install the hotfixes now and stop dynamic_server until you can.
Applies to: Check Point Firewall, Security Gateway, Scalable Platforms, Security Management and Multi-Domain Management on Gaia versions listed as affected in sk1000362 and sk1000291
- Open sk1000362 and sk1000291 and note the emergency hotfix (Jumbo Hotfix Accumulator take) for your Gaia version.
- Check the installed Jumbo take on each Security Gateway, Scalable Platform and Management Server (cpinfo -y all or in Gaia Portal).
- If you cannot patch today, stop the dynamic_server process and prevent it from restarting, as Check Point advises in sk1000362, until the hotfix is installed.
- Install the listed hotfix via CPUSE in Gaia Portal or with the installer CLI and reboot when asked. Start with gateways that have an internet-facing Mobile Access portal.
- Limit Gaia shell and Gaia Portal accounts to administrators and remove unused local users.
- Restrict Gaia Portal and Mobile Access portal exposure; attackers reached the box through the Mobile Access portal (PHP2Shell) before escalating to root.
- Review expert-mode and shell history on the appliances for commands that did not run through the Clish wrapper, which Check Point names as a sign of exploitation.
- On gateways whose Mobile Access portal was exposed, hunt for the Check Point Research indicators: session files containing upload_progress_pwn under /opt/CPcvpn-*/tmp/, unexpected zz*.tpl or challenge_render.tpl templates, /tmp/.up.tpl, /tmp/CPconfigdaemon, slot_CPconfigdaemon, /lib/libcpfwcommon.so, /tmp/.p_sock and a listener on TCP 11072.
- Check vCenter and ESXi for SSH sessions from a gateway, especially as vpxuser, and for /tmp/des or DREAM_ANNEXATION.txt on ESXi hosts. If you find any, treat the gateway as compromised: rebuild it from clean media and rotate all credentials it held.
Sources:
- https://support.checkpoint.com/results/sk/sk1000362
- https://support.checkpoint.com/results/sk/sk1000291
- https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/
- https://www.bleepingcomputer.com/news/security/check-point-gateways-hacked-via-php2shell-to-deploy-vmware-esxi-wiper/
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.