Check Point issues emergency hotfixes for zero-day root-access flaw

Check Point issued emergency hotfixes for CVE-2026-123039 after attackers exploited the high-severity zero-day since late October to gain root privileges and maintain persistence on vulnerable devices. BleepingComputer reported the development.

The flaw, tracked as CVE-2026-123039, is a local privilege escalation bug in the DynamicCLI IPC interface. The interface passes privileged commands to the root-level Gaia OS dynamic_server daemon.

The Gaia OS DynamicCLI daemon runs with root privileges and listens on a world-writable local socket path, /tmp/dynamic_socket. It does not require authentication from connecting processes. An authenticated local user can send a command through the socket and have that command run with root privileges.

Products exposed to CVE-2026-123039 attacks include Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway, and Security Management Server. In a separate report, Check Point said intruders entered through the Mobile Access portal using the PHP2Shell vulnerability, then escalated to root with CVE-2026-123039 zero-day exploits.

After gaining root access, the intruders deployed webshells and installed the TSGA backdoor plus TSProxy malware, seen in Ivanti appliance attacks. The attackers next shifted from the breached gateway to a VMware ESXi system and released destructive wiper software, malware that erases disks.

Check Point said in a Thursday security advisory that it saw active exploitation of the flaw on a couple of dozen customers. The company stated, “Check Point observed an active exploit of this vulnerability against a couple of dozen customers.”

In September, Check Point warned that attackers exploited two other critical zero-day remote code execution flaws. The flawed products were Security Management Server, tracked as CVE-2026-93616, and Security Gateway, tracked as CVE-2026-85102. Those attacks did not require privileges on targeted systems.

CISA has placed five Check Point flaws on its actively exploited vulnerabilities catalog during the last two years. Ransomware cartels have also abused two of those flaws.

Check Point shared indicators of compromise for the vulnerability. Evidence of compromise includes commands associated with exploitation attempts. Uncommon or absent use of the system() sink in legitimate traffic can signal compromise. Commands that do not use the default Clish wrapper suggest root execution through the socket and require investigation.

Check Point advised teams unable to deploy the hotfixes immediately to halt the dynamic_server process and block its restart as a temporary mitigation. Emergency hotfixes for CVE-2026-123039 are available for the affected products.