> Source: [sk1000302](https://support.checkpoint.com/results/sk/sk1000302)

# sk1000302 - Check Point Response to CVE-2026-109618 and CVE-2026-109619 - PHP vulnerabilities may allow Remote Code Execution through Firewall web interfaces

| Property | Value |
|----------|-------|
| Solution ID | sk1000302 |
| Date Created | 2026-10-21 |
| Last Modified | 2026-10-23 |
| Technical Level | General |
| Products | Security Gateway, Spark Firewall (Locally Managed), Cloud Firewall, Check Point Firewall, Spark Firewall (Centrally Managed) |
| Versions | R82.10, R82, R81.20, R82.00.X, R81.10.X, R82.20 |
| OS | Gaia, Gaia Embedded |

## Symptoms

- * Under certain circumstances, PHP vulnerabilities may allow Remote Code Execution through firewall web interfaces.

* These issues received the IDs [CVE-2026-109618](https://www.cve.org/CVERecord?id=CVE-2026-109618) and [CVE-2026-109619](https://www.cve.org/CVERecord?id=CVE-2026-109619) with CVSS: 9.2.

* **Affected Products:**

  Check Point Force Firewalls, Check Point Spark Firewalls, and Cloud Firewalls that use one or more of these features:
  * Mobile Access Portal (not applicable to Spark Firewalls)
  * Remote Access VPN with SSL Network Extender (not applicable to Spark Firewalls)
  * Remote Access VPN with SAML Realm authentication enabled
  * Identity Awareness Captive Portal enabled
* **Affected Versions:**

  * R81.20, R82, R82.10, R82.20
  * R80, R80.10, R80.20, R80.30, R80.40, R81, R81.10 (all EoS)
  * Spark Firewalls R81.10.x, R82.00.x
  * Spark Firewalls R77.20.x, R80.20.x (all EoS)

**Note** - Check Point Portal and SaaS services are already patched against these vulnerabilities.

### Mitigation

> **Important Notes:**
>
> * **October, 22, 2026 at 21:50 GMT update:** Check Point is expecting to deliver a permanent fix based on the latest PHP code by October 23, 17:00 GMT.
>
> * Check Point Firewalls R82.20 protect themselves through the Check Point IPS signature "[PHP Remote Code Execution (CVE-2026-109618, CVE-2026-109619)](https://advisories.checkpoint.com/advisories/)" even when IPS is **not** enabled and HTTPS Inspection is **not** active on these Check Point Firewalls.
>
> #### (1) Mitigation procedure for Check Point Firewalls (including VSNext / Traditional VSX modes) {#TOC01}
>
> > Show / Hide this section   
> > Follow **one** of the available edit options below.
> >
> > Note - In ClusterXL, you must perform the steps below on each ClusterXL Member.
> >
> > **Option 1** - Use the Vi editor:
> >
> > 1. Connect to the command line on the Check Point Firewall.
> >
> > 2. Log in to the Expert mode.
> >
> > 3. If this Check Point Firewall is configured in the VSNext / Traditional VSX mode, go to the context with ID 0:
> >
> >    |-----------|
> >    | `vsenv 0` |
> >
> > 4. Back up the current file:
> >
> >    |-----------------------------------------------------|
> >    | `cp -v $CPDIR/web/Apache/conf/cp-httpd.conf{,_BKP}` |
> >
> > 5. Edit the current file:
> >
> >    |-------------------------------------------|
> >    | `vi $CPDIR/web/Apache/conf/cp-httpd.conf` |
> >
> > 6. Add these lines **at the end** of the file:
> >
> >    |-----------------------------------------------------------------------------|
> >    | `<If "req('Content-Type') =~ /multipart/i">` ` Require all denied` ` </If>` |
> >
> >    **Important:** Make sure that this "`<If>...</If>`" block appears only one time in the `cp-httpd.conf` file.
> > 7. Save the changes in the file and exit Vi editor.
> >
> > 8. Restart the relevant services.
> >
> >    Run the commands in the order listed:
> >    * On Check Point Firewalls R82.20:
> >
> >      |----------------------------------|
> >      | `mpclient stop-managed-portals`  |
> >      | `mpclient start-managed-portals` |
> >
> >    * On Check Point Firewalls R82.10 and R82:
> >
> >      |---------------------------|
> >      | `mpclient stopallportals` |
> >      | `mpclient startall`       |
> >
> >    * On Check Point Firewalls R81.20:
> >
> >      |--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
> >      | `mpclient list | /usr/bin/xargs -I{} /usr/bin/sh -c 'mpclient status {} | /usr/bin/grep -q "Portal is running" && (mpclient restart {} | grep -q "Portal restarted" || echo "Failed to handle the portal {}" )' ; echo "Done"` |
> >
> > **Option 2** - Use one pipeline of CLI commands:
> >
> > 1. Connect to the command line on the Check Point Firewall.
> >
> > 2. Log in to the Expert mode.
> >
> > 3. Back up the current file:
> >
> >    |-----------------------------------------------------|
> >    | `cp -v $CPDIR/web/Apache/conf/cp-httpd.conf{,_BKP}` |
> >
> > 4. Run this pipeline of CLI commands:
> >
> >    **Important:** Make sure that after running these commands, this "`<If "req('Content-Type') =~ /multipart/i">...</If>` block appears only one time in the `cp-httpd.conf` file.
> >    * On Check Point Firewalls R82.20:
> >
> >      |------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
> >      | `printf '\n%s\n%s\n%s\n' $'<If "req(\'Content-Type\') =~ /multipart/i">' ' Require all denied' '</If>' >> $CPDIR/web/Apache/conf/cp-httpd.conf ; mpclient stop-managed-portals ; mpclient start-managed-portals` |
> >
> >    * On Check Point Firewalls R82.10 and R82:
> >
> >      |-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
> >      | `printf '\n%s\n%s\n%s\n' $'<If "req(\'Content-Type\') =~ /multipart/i">' ' Require all denied' '</If>' >> $CPDIR/web/Apache/conf/cp-httpd.conf ; mpclient stopallportals ; mpclient startall` |
> >
> >    * On Check Point Firewalls R81.20:
> >
> >      |--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
> >      | `printf '\n%s\n%s\n%s\n' $'<If "req(\'Content-Type\') =~ /multipart/i">' ' Require all denied' '</If>' >> $CPDIR/web/Apache/conf/cp-httpd.conf ; mpclient list | /usr/bin/xargs -I{} /usr/bin/sh -c 'mpclient status {} | /usr/bin/grep -q "Portal is running" && (mpclient restart {} | grep -q "Portal restarted" || echo "Failed to handle the portal {}" )' ; echo "Done"` |
>
> #### (2) Mitigation procedure for Maestro and ElasticXL (including VSNext / Traditional VSX modes) {#TOC02}
>
> > Show / Hide this section   
> > **Option 1** - Use the Vi editor:
> >
> > 1. Connect to the command line on the Security Group.
> >
> > 2. Log in to the Expert mode.
> >
> > 3. If this Security Group is configured in the VSNext / Traditional VSX mode, go to the context with ID 0:
> >
> >    |-----------------|
> >    | `g_all vsenv 0` |
> >
> > 4. Back up the current file:
> >
> >    |-----------------------------------------------------------|
> >    | `g_all cp -v $CPDIR/web/Apache/conf/cp-httpd.conf{,_BKP}` |
> >
> > 5. Edit the current file:
> >
> >    |-------------------------------------------|
> >    | `vi $CPDIR/web/Apache/conf/cp-httpd.conf` |
> >
> > 6. Add these lines **at the end** of the file:
> >
> >    |-----------------------------------------------------------------------------|
> >    | `<If "req('Content-Type') =~ /multipart/i">` ` Require all denied` ` </If>` |
> >
> >    **Important:** Make sure that this "`<If>...</If>`" block appears only one time in the `cp-httpd.conf` file.
> > 7. Save the changes in the file and exit Vi editor.
> >
> > 8. Copy the modified file to all Security Group Members:
> >
> >    |------------------------------------------------------|
> >    | `asg_cp2blades $CPDIR/web/Apache/conf/cp-httpd.conf` |
> >
> > 9. Restart the relevant services.
> >
> >    Run the commands in the order listed:
> >    * On Security Groups R82.20:
> >
> >      |----------------------------------------|
> >      | `g_all mpclient stop-managed-portals`  |
> >      | `g_all mpclient start-managed-portals` |
> >
> >    * On Security Groups R82.10 and R82:
> >
> >      |---------------------------------|
> >      | `g_all mpclient stopallportals` |
> >      | `g_all mpclient startall`       |
> >
> >    * On Security Groups R81.20:
> >
> >      |--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
> >      | `g_all mpclient list | /usr/bin/xargs -I{} /usr/bin/sh -c 'mpclient status {} | /usr/bin/grep -q "Portal is running" && (mpclient restart {} | grep -q "Portal restarted" || echo "Failed to handle the portal {}" )' ; echo "Done"` |
> >
> > **Option 2** - Use one pipeline of CLI commands:
> >
> > 1. Connect to the command line on the Security Group.
> >
> > 2. Log in to the Expert mode.
> >
> > 3. Back up the current file:
> >
> >    |-----------------------------------------------------------|
> >    | `g_all cp -v $CPDIR/web/Apache/conf/cp-httpd.conf{,_BKP}` |
> >
> > 4. Run this pipeline of CLI commands:
> >
> >    **Important:** Make sure that after running these commands, this "`<If "req('Content-Type') =~ /multipart/i">...</If>`" block appears only one time in the `cp-httpd.conf` file.
> >    * On Security Groups R82.20:
> >
> >      |------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
> >      | `g_all printf '\n%s\n%s\n%s\n' $'<If "req(\'Content-Type\') =~ /multipart/i">' ' Require all denied' '</If>' >> $CPDIR/web/Apache/conf/cp-httpd.conf ; g_all mpclient stop-managed-portals ; g_all mpclient start-managed-portals` |
> >
> >    * On Security Groups R82.10 and R82:
> >
> >      |-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
> >      | `g_all printf '\n%s\n%s\n%s\n' $'<If "req(\'Content-Type\') =~ /multipart/i">' ' Require all denied' '</If>' >> $CPDIR/web/Apache/conf/cp-httpd.conf ; g_all mpclient stopallportals ; g_all mpclient startall` |
> >
> >    * On Security Groups R81.20:
> >
> >      |--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
> >      | `g_all printf '\n%s\n%s\n%s\n' $'<If "req(\'Content-Type\') =~ /multipart/i">' ' Require all denied' '</If>' >> $CPDIR/web/Apache/conf/cp-httpd.conf ; g_all mpclient list | /usr/bin/xargs -I{} /usr/bin/sh -c 'mpclient status {} | /usr/bin/grep -q "Portal is running" && (mpclient restart {} | grep -q "Portal restarted" || echo "Failed to handle the portal {}" )' ; echo "Done"` |
>
> #### (3) Mitigation procedure for Check Point Spark Firewalls {#TOC03}
>
> > Show / Hide this section   
> > **Use one pipeline of CLI commands:**
> >
> > 1. Connect to the command line on the Check Point Spark Firewall.
> >
> > 2. Log in to the Expert mode.
> >
> > 3. Back up the current file:
> >
> >    |------------------------------------------|
> >    | `cp -v $CPDIR/conf/cp-httpd.conf{,_BKP}` |
> >
> > 4. Run this pipeline of CLI commands:
> >
> >    **Important:** Make sure that after running these commands, this "`<If "req('Content-Type') =~ /multipart/i">...</If>`" block appears only one time in the `cp-httpd.conf` file.
> >
> >    |--------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
> >    | `printf '\n%s\n%s\n%s\n' $'<If "req(\'Content-Type\') =~ /multipart/i">' ' Require all denied' '</If>' >> $CPDIR/conf/cp-httpd.conf ; sfwd_stop ; sleep 3s ; sfwd_start` |

## Solution

The fix is planned for the release on **November 11, 2026**, as part of the Jumbo Hotfix Accumulators.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content