Check Point Patches Exploited Zero-Day Flaw for Root Access

Check Point Software has released emergency hotfixes for a high-severity zero-day vulnerability, tracked as CVE-2026-123039, that attackers have exploited since late October to gain root privileges and establish persistence on vulnerable devices. Observed against a couple of dozen customers, the local privilege escalation flaw affects Check Point Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway, and Security Management Server. In recorded intrusions, threat actors chained portal compromise with the flaw to install backdoors and deploy destructive wiper malware on VMware ESXi hosts, underscoring the urgency for administrators to apply vendor updates.

Key Facts

How Does CVE-2026-123039 Work?

CVE-2026-123039 is a high-severity local privilege escalation vulnerability in the DynamicCLI Inter-Process Communication (IPC) interface that sends privileged command requests to the Gaia OS dynamic_server daemon. Because the daemon runs as root on a world-writable local socket without authenticating connecting processes, an authenticated local user can execute commands as root.

In its security advisory, Check Point explained the root cause of the weakness in the Gaia OS DynamicCLI service:

"The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root."

Check Point security advisory, as reported by BleepingComputer

The vulnerability impacts five product lines: Check Point Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway, and Security Management Server.

Because the DynamicCLI daemon runs with root privileges and listens on an unauthenticated local socket, an authenticated local user can run arbitrary commands as root on vulnerable Check Point products.

Is the Flaw Being Exploited in Attacks?

Yes, Check Point confirmed active zero-day exploitation of CVE-2026-123039 against a couple of dozen customers since late October. In observed intrusions, attackers chained initial portal access with this flaw to obtain root privileges, install backdoors, and pivot to VMware ESXi hosts to deploy destructive wiper malware.

Check Point detailed the intrusion chain in a separate report. Attackers first gained access to the Mobile Access portal by exploiting the PHP2Shell vulnerability, then used CVE-2026-123039 exploits to escalate privileges to root. From there, the threat actors dropped webshells and installed the TSGA backdoor and TSProxy malware, tools previously observed during investigations into attacks targeting Ivanti appliances, before pivoting from the compromised gateway to a VMware ESXi host to deploy destructive wiper malware.

The incident follows warnings in September regarding two critical unprivileged remote code execution (RCE) zero-day flaws in Security Management Server (CVE-2026-93616) and Security Gateway (CVE-2026-85102). Over the past two years, the US Cybersecurity and Infrastructure Security Agency (CISA) has added five Check Point flaws to its catalog of actively exploited vulnerabilities, two of which were also abused by ransomware gangs.

Check Point observed active exploitation of CVE-2026-123039 against a couple of dozen customers in attack chains that moved from Mobile Access portal compromise to ESXi wiper deployment.

How Can Administrators Detect Compromise or Mitigate Risk?

Security teams should apply Check Point's official emergency hotfixes immediately to remediate CVE-2026-123039. Organisations unable to patch straight away should stop the dynamic_server process and prevent it from restarting, while checking for indicators of compromise and suspicious commands executed without the default Clish wrapper.

Indicators of compromise (IOCs) are published in the original report. Check Point also advised defenders to inspect affected systems for commands commonly associated with exploitation attempts, usage of the system() sink—which is uncommon or absent in legitimate traffic—and any command executed without the default Clish wrapper, as this indicates execution as root through the local socket and requires investigation.

Stopping the dynamic_server daemon and preventing it from restarting is Check Point's recommended temporary mitigation until the emergency hotfixes are installed.

What Should You Do?

• Apply Check Point's official emergency hotfixes for CVE-2026-123039 across all affected Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway, and Security Management Server deployments.
• If hotfixes cannot be deployed immediately, stop the dynamic_server process and prevent it from restarting as a temporary mitigation.
• Review systems for the indicators of compromise published in the original report, as well as exploitation-linked commands, unusual system() sink activity, and commands run outside the default Clish wrapper.
• Ensure your Mobile Access portal is protected against the PHP2Shell vulnerability used for initial access in the observed attack chain, and verify the integrity of connected VMware ESXi hosts.
• Malaysian organisations that detect suspicious activity or suspect a security incident can report it to Cyber999 (MyCERT) for incident response guidance.

Common Questions

Which Check Point products are affected by CVE-2026-123039?

Check Point reported that the vulnerability affects its Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway, and Security Management Server products. The source report does not specify affected or fixed version numbers, so administrators should apply Check Point's official emergency hotfixes for vulnerable devices.

Can attackers exploit CVE-2026-123039 on its own without local access?

No, CVE-2026-123039 is a local privilege escalation flaw that requires an authenticated local user to send commands to /tmp/dynamic_socket. However, attackers in observed intrusions first gained access to the Mobile Access portal by exploiting the PHP2Shell vulnerability before elevating privileges to root.

What temporary workaround exists if emergency hotfixes cannot be installed immediately?

Check Point advises security teams unable to deploy the CVE-2026-123039 hotfixes straight away to stop the dynamic_server process and prevent it from restarting. Administrators should also inspect devices for indicators of compromise, unusual system() sink usage, and commands executed without the default Clish wrapper.

Sources and Methodology

This dispatch is based solely on the BleepingComputer report published on November 13, 2026, by Sergiu Gatlan. No external advisories, vendor pages, or separate technical documents were independently reviewed or verified.