Check Point Software has released emergency hotfixes for a high-severity vulnerability in its security gateway products that threat actors have been actively exploiting since late October. According to reporting by BleepingComputer, successful exploitation grants attackers root privileges on vulnerable devices and has been used to establish persistence — meaning this is not smash-and-grab exploitation, but deliberate, long-duration access to network perimeter infrastructure.
Let me be blunt about why this matters: your Check Point gateway is not just another asset. It is the device that terminates your VPN tunnels, inspects your north-south traffic, and often holds cleartext credentials, certificates, and session data for everything passing through it. Root-level compromise of a perimeter gateway is functionally equivalent to handing an adversary a wiretap, a credential store, and a beachhead inside your network — all in one box. If you run Check Point gateways and have not applied the emergency hotfixes, treat this as an active incident until proven otherwise.
Technical Analysis
What we know
- Affected platform: Check Point Security Gateways (Gaia OS-based appliances and software blades exposed to management or VPN-facing interfaces).
- Impact: Remote exploitation yields root privileges — the highest privilege level on the appliance, equivalent to expert-mode access.
- Post-exploitation behavior: Attackers are establishing persistence, indicating follow-on access is intended to survive reboots and basic credential resets.
- Exploitation status: Confirmed in-the-wild exploitation since late October. This is not theoretical, not a PoC, and not a vendor-proactive disclosure — organizations have already been breached via this flaw.
- Vendor response: Emergency hotfixes released out-of-band. Out-of-cycle fixes from Check Point are rare and signal elevated vendor confidence in both severity and active abuse.
Attack chain (defender's view)
While full technical details are being held back to limit further exploitation, the observed pattern follows a familiar perimeter-device playbook:
- Initial access — exploitation of the flaw against an internet-reachable gateway component.
- Privilege attainment — the exploit path lands the attacker directly at root, bypassing the standard
clishrestricted shell and dropping them into full OS control. - Persistence installation — typical mechanisms on Gaia/Linux-based appliances include rogue local user accounts, injected SSH
authorized_keysentries, cron job or rc-script modifications, and web shell or binary implants dropped under/opt,/var/log, or web-accessible directories. - Follow-on activity — credential harvesting (gateway-local accounts, VPN user databases), traffic interception, and lateral movement into internal segments.
Why patching alone is insufficient
Because exploitation predates the hotfix by weeks, any gateway that was exposed and unpatched during the exploitation window must be treated as potentially compromised. Hotfixing closes the door; it does not evict anyone already inside. Persistence installed at root will survive patching. This is the single most common failure mode I see in perimeter-device IR engagements — teams patch, declare victory, and miss the implant that was installed three weeks earlier.
Detection & Response
The detections below target the post-exploitation behaviors described in the reporting: root-level access, persistence mechanisms, and anomalous process/network activity on the gateway. Forward Gaia OS syslogs (and auditd logs where available) to your SIEM — if you are not already ingesting these, that gap needs to close today.
---
title: Check Point Gaia Suspicious Root-Level Process Execution
id: 3f8a1c72-6b4d-4e9a-b2c7-9d1e5f0a3b4c
status: experimental
description: Detects suspicious child processes spawned by Check Point web/VPN services or execution of shells and tooling from atypical paths on Gaia OS gateways, consistent with post-exploitation activity following root compromise.
references:
- https://www.bleepingcomputer.com/news/security/check-point-patches-zero-day-that-lets-hackers-get-root-access/
- https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/01/15
tags:
- attack.execution
- attack.t1059.004
- attack.privilege_escalation
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentCommandLine|contains:
- '/opt/CP'
- 'httpd'
- 'cfwm'
selection_child:
CommandLine|contains:
- '/bin/sh'
- '/bin/bash'
- 'curl '
- 'wget '
- 'chmod +x'
- 'useradd'
- 'adduser'
condition: selection_parent and selection_child
falsepositives:
- Rare; legitimate Check Point service processes do not normally spawn interactive shells or download tooling
level: high
---
title: Linux Persistence via SSH Authorized Keys or Cron Modification
id: 8c2e4f19-1a7b-4d35-9e6c-2b8d0f4a7c9e
status: experimental
description: Detects modification of SSH authorized_keys files or cron configuration on gateway appliances, a common persistence mechanism following root-level compromise of network devices.
references:
- https://www.bleepingcomputer.com/news/security/check-point-patches-zero-day-that-lets-hackers-get-root-access/
- https://attack.mitre.org/techniques/T1098.004/
- https://attack.mitre.org/techniques/T1053.003/
author: Security Arsenal
date: 2026/01/15
tags:
- attack.persistence
- attack.t1098.004
- attack.t1053.003
logsource:
category: file_event
product: linux
detection:
selection:
TargetFilename|contains:
- '/.ssh/authorized_keys'
- '/etc/crontab'
- '/etc/cron.d/'
- '/var/spool/cron/'
- '/etc/rc.d/'
condition: selection
falsepositives:
- Legitimate administrator key rotation and scheduled task changes — correlate against change tickets and maintenance windows
level: high
---
title: New Local Account Creation on Gaia Appliance
id: b71d3e52-9c6f-4a28-bd41-5e9c0a2f8d36
status: experimental
description: Detects creation of new local user accounts on Linux-based security appliances, a hallmark persistence technique observed in perimeter device intrusions.
references:
- https://attack.mitre.org/techniques/T1136.001/
author: Security Arsenal
date: 2026/01/15
tags:
- attack.persistence
- attack.t1136.001
logsource:
category: process_creation
product: linux
detection:
selection:
CommandLine|contains:
- 'useradd '
- 'adduser '
- 'usermod -aG'
condition: selection
falsepositives:
- Legitimate provisioning activity — new accounts on a perimeter gateway outside a change window should always be investigated
level: high
For Sentinel/Defender environments ingesting Gaia syslog via CEF or a Linux collector, hunt for persistence and execution indicators across your gateway estate:
// Hunt for account creation, SSH key changes, and cron modifications on Check Point gateways
let Lookback = 45d; // Extend back through the reported exploitation window (late October onward)
union isfuzzy=true
(Syslog
| where TimeGenerated > ago(Lookback)
| where Computer has_any ("checkpoint", "fw-", "gw-") // Adjust to your gateway host naming convention
| where SyslogMessage has_any ("useradd", "adduser", "authorized_keys", "crontab", "cron.d", "new user")
| project TimeGenerated, Computer, ProcessName, SyslogMessage, HostIP),
(CommonSecurityLog
| where TimeGenerated > ago(Lookback)
| where DeviceVendor =~ "Check Point"
| where Message has_any ("useradd", "authorized_keys", "new user", "root login", "expert mode")
| project TimeGenerated, DeviceName, SourceIP, DestinationIP, Message)
| order by TimeGenerated desc
// Identify external IPs authenticating to or communicating with gateways outside expected admin sources
let AdminSources = dynamic(["10.0.0.0/8"]); // Replace with your approved management networks
CommonSecurityLog
| where TimeGenerated > ago(45d)
| where DeviceVendor =~ "Check Point"
| where ipv4_is_private(SourceIP) == false
| where Message has_any ("login", "authentication", "accepted", "session opened")
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Events = count(), SampleMessages = make_set(Message, 5) by SourceIP, DeviceName
| order by Events desc
If you have Velociraptor deployed on Linux collectors adjacent to (or on) your gateway infrastructure, this artifact sweeps for the persistence artifacts most commonly left behind in perimeter device compromises:
-- Hunt for persistence artifacts: rogue SSH keys, cron entries, and recently modified binaries
LET ssh_keys = SELECT FullPath, Mtime, Size,
read_file(filename=FullPath, length=2048) AS KeyContent
FROM glob(globs=['/root/.ssh/authorized_keys', '/home/*/.ssh/authorized_keys'])
WHERE Mtime > (now() - 60 * 24 * 3600) -- Modified in last 60 days
LET cron_mods = SELECT FullPath, Mtime, Size,
read_file(filename=FullPath, length=4096) AS CronContent
FROM glob(globs=['/etc/crontab', '/etc/cron.d/*', '/var/spool/cron/*'])
WHERE Mtime > (now() - 60 * 24 * 3600)
LET recent_root_procs = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Username =~ 'root'
AND (Exe =~ '/tmp|/var/tmp|/dev/shm' OR CommandLine =~ 'base64|curl|wget|nc -')
SELECT 'SSH Key' AS ArtifactType, FullPath, Mtime, KeyContent AS Detail FROM ssh_keys
UNION ALL
SELECT 'Cron' AS ArtifactType, FullPath, Mtime, CronContent AS Detail FROM cron_mods
UNION ALL
SELECT 'Process' AS ArtifactType, Exe AS FullPath, CreateTime AS Mtime, CommandLine AS Detail FROM recent_root_procs
The following Bash script should be run in expert mode on each gateway to verify hotfix status and sweep for the persistence indicators described above. Capture output to a file and ship it off-box for analysis — do not trust a potentially compromised appliance to investigate itself without preserving evidence first.
#!/bin/bash
# Check Point Gateway Compromise Assessment & Hotfix Verification
# Run in expert mode. Preserve output before making ANY changes.
OUT="/var/log/gw_assessment_$(date +%Y%m%d_%H%M%S).log"
exec > >(tee -a "$OUT") 2>&1
echo "===== [1] Installed Hotfixes / Jumbo Take ====="
# Verify the emergency hotfix is installed — cross-reference against Check Point sk advisory
cpinfo -y all 2>/dev/null | tail -30
echo "===== [2] Local User Accounts (look for unauthorized additions) ====="
cat /etc/passwd | awk -F: '$3 >= 1000 || $3 == 0 {print $1":"$3":"$7}'
echo "===== [3] Recently Modified Persistence Locations ====="
find /root/.ssh /home/*/.ssh /etc/cron.d /var/spool/cron /etc/rc.d /etc/init.d -mtime -60 -ls 2>/dev/null
echo "===== [4] Suspicious Files in Temp/Web-Accessible Paths ====="
find /tmp /var/tmp /dev/shm /opt/CPsuite-R*/fw1/bin -type f -mtime -60 2>/dev/null | head -50
echo "===== [5] Active Network Connections (unexpected outbound listeners/connections) ====="
netstat -tunap 2>/dev/null | grep -v ESTABLISHED | head -40
netstat -tunap 2>/dev/null | grep ESTABLISHED | grep -viE 'https|ssh|snmp|ntp' | head -40
echo "===== [6] Recent Root/Expert-Mode Logins ====="
last -i | head -30
grep -h "session opened" /var/log/messages* 2>/dev/null | tail -30
echo "===== [7] Crontab Contents ====="
crontab -l 2>/dev/null
cat /etc/crontab 2>/dev/null
echo "Assessment complete. Preserve $OUT off-box before remediation."
Remediation
- Apply the emergency hotfixes immediately. Obtain the fixes and installation instructions directly from Check Point's official channels — start with the Check Point Support Center (supportcenter.checkpoint.com) and the relevant sk advisory referenced in the vendor notification. Verify installation per appliance with
cpinfo -y all. Do not assume clustering synchronizes the fix — verify each cluster member individually. - Treat unpatched-during-window gateways as potentially compromised. Any appliance internet-exposed and unpatched since late October requires a compromise assessment (use the script above) before you declare it clean. If you find persistence artifacts, escalate to full IR: isolate the device, image relevant filesystems if feasible, and rebuild from known-good media rather than cleaning in place.
- Rotate credentials on any gateway within the exposure window. This includes local admin accounts, VPN user credentials stored on the gateway, certificates/private keys resident on the device, and any credentials the gateway uses to authenticate to other systems (RADIUS secrets, LDAP bind accounts, API keys). Root compromise means all of it is suspect.
- Restrict management interface exposure. Gateway management (SmartConsole access, SSH, web UI) should never be internet-reachable. Enforce access from dedicated management networks/jump hosts only, and audit your external attack surface today to confirm.
- Review logs back to late October. The exploitation window spans weeks. If your gateway syslog retention is shorter than that, pull whatever SIEM/archive copies exist. Gaps in gateway logging during the window are themselves an investigative red flag.
- Hunt for downstream lateral movement. A compromised gateway is a pivot point. Review authentication and traffic logs for unusual access from the gateway's internal interfaces toward domain controllers, management infrastructure, and sensitive segments.
- Monitor for the CISA KEV listing. Actively exploited perimeter-device flaws of this class are routinely added to CISA's Known Exploited Vulnerabilities catalog, which carries a federal remediation deadline and is a strong forcing function for internal escalation even in private-sector organizations.
The broader lesson here is one I've delivered after too many perimeter-device IR engagements: your security appliances are part of your attack surface, often the least-monitored part, and they run at the highest privilege in your environment. They deserve the same telemetry coverage, patch discipline, and compromise-assessment rigor as your domain controllers. This campaign will not be the last one to prove that point.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.