How to Fix CVE-2026-123039 in Check Point Multiple Products

The two-minute check

1. Open the admin console or settings screen on each device running Check Point Multiple Products.
2. Check whether more than one local user account can log in to that device.
3. Check whether any contractor, vendor, or former employee still has a local login on that device.
4. Check whether the device is reachable only by people you trust, or by a wider pool of users.

When you can stop reading

If you don't run Check Point Multiple Products anywhere in your business, this flaw does not apply to you. You can close this tab.

If the computer, phone, or server you run Check Point Multiple Products on is a single-user device, your exposure is lower. The flaw needs a local user account to already exist on the machine. A device with no other logins and no shared access is a smaller target.

What the official record says

This flaw carries a Common Vulnerability Scoring System (CVSS) score of 7.8, rated HIGH, according to the National Vulnerability Database (NVD).

The scoring detail says the attack has to come from someone already logged in locally, not over the internet. It also says the attacker needs only a low-privilege account, not an admin one. No tricking a user into clicking anything is required, and a successful attack can read, change, or shut down the whole system.

This flaw is listed on the Known Exploited Vulnerabilities (KEV) catalog maintained by the Cybersecurity and Infrastructure Security Agency. That means criminals are already using it in the wild, not just researchers. You can confirm that listing on the CISA KEV catalog entry for this flaw.

The Exploit Prediction Scoring System (EPSS) puts the chance of exploitation in the next 30 days at 2.2%, which sits at the 82.7th percentile compared to other flaws, per the NVD record. That is a low chance of exploitation in the next 30 days. EPSS forecasts activity, not how severe the flaw itself is.

What that means for a business like yours

The real-world risk here is someone who already has, or gets, a basic login on a box running Check Point Multiple Products. That could be a disgruntled employee, a contractor with leftover access, or malware that already landed on the machine. Once they connect to the local socket, they can run commands as the system's highest-privilege account. That turns a minor foothold into full control of that device.

Businesses with shared admin consoles or multiple local accounts on the same box carry more exposure. Our cybersecurity services page covers how we help businesses reduce exactly this kind of local-privilege risk.

If someone else manages your IT

Send your provider a short message. Keep it to a few plain sentences, like this one:

"Please check whether we run Check Point Multiple Products anywhere in our environment. If we do, please confirm how many local accounts exist on each device. Please also confirm this is tracked against CVE-2026-123039 and the CISA KEV catalog."

If you manage it yourself

1. List every device where Check Point Multiple Products is installed.
2. Check the local user accounts on each device.
3. Remove any account that no longer needs access.
4. Confirm that remote or shared admin logins require a separate password per person.
5. Read the vendor's own notes on this issue at the Check Point advisory.
6. Set a reminder to recheck that advisory weekly until it lists a fix.

The answer is now. This flaw is already on the CISA Known Exploited Vulnerabilities catalog, with a federal remediation due date of November 16, 2026. That date applies directly to federal agencies, but it is a useful marker for any business. If attackers are using a flaw against government systems, they can use it against yours too.

The record does not name a fixed version, so there is nothing to install yet. What you can confirm is exposure, not a patch. Recheck the local account list on each affected device and confirm it still matches what you expect. Recheck the vendor advisory page for any update to the fix status.

Since no fix exists yet, your real options are about shrinking who can reach the flaw. Reducing local accounts on each device limits who could ever trigger this bug. It does not stop someone who already has a valid login.

Restricting who gets local access in the first place is the strongest interim step. A privileged access management setup, like the one described on our privileged access management page, limits which accounts can reach sensitive systems at all. It does not fix the underlying flaw, but it shrinks your exposed surface.

Multi-factor authentication (MFA) on any remote access to these devices adds another layer. It does not stop a local user who is already logged in, but it does slow down an outsider trying to get that first login.

Do I have to do anything if we only use this at home?

If you run Check Point Multiple Products on a personal device with no other local accounts, your exposure is low. The flaw needs another local user account to already exist on the same machine.

Will this break anything if we remove local accounts?

Removing accounts that nobody uses should not affect normal operation. Confirm with whoever manages the device before removing any account you are unsure about.

Does the vendor have a patch yet?

The record does not list a fixed version as of this writing. Check the vendor's advisory for the current status.

Does this affect regulated data we handle?

If your business handles regulated data, check your access-control obligations. Our HIPAA compliance and FTC Safeguards Rule pages outline what those access-control rules expect.

Can LayerLogix just handle this for us?

Yes. Our managed IT services cover exactly this kind of tracking, with 20+ years of experience and 100% U.S.-based support. Start with a free IT assessment or contact us directly.