Check Point rushes hotfixes for exploited root privilege zero-day

By Tom Whitfield

Attackers have exploited a high-severity zero-day in Check Point's Gaia OS since late October, escalating to root on roughly two dozen customer appliances before dropping backdoors and, in at least one chain, a wiper. Check Point shipped emergency hotfixes on Thursday. Patch first, read second.

The flaw, tracked as CVE-2026-123039, is a local privilege escalation in the DynamicCLI inter-process communication interface. That interface forwards privileged command requests to the dynamic_server daemon, which runs as root. The defect is almost comically direct: the daemon listens on a world-writable local socket, /tmp/dynamic_socket, and authenticates nothing that connects to it.

"An authenticated local user can send a command to the socket and have it executed as root," Check Point explained in its advisory. Translation: any foothold on the box, however modest, is one socket write away from full control.

What did the attackers actually do?

"Check Point observed an active exploit of this vulnerability against a couple of dozen customers," the vendor said. The follow-up report reconstructs the chain, and it ends badly.

• Initial access via the Mobile Access portal, using the PHP2Shell vulnerability.
• Privilege escalation to root through CVE-2026-123039 zero-day exploits.
• Deployment of webshells plus the TSGA backdoor and TSProxy malware — tooling previously seen in attacks on Ivanti appliances.
• Lateral movement from the compromised gateway to a VMware ESXi host.
• Detonation of destructive wiper malware on that host.

So this is not credential theft for resale. The endgame was destruction, which narrows the likely motive list considerably.

Which products are exposed?

CVE-2026-123039 affects a broad slice of the Check Point portfolio:

• Firewall
• Multi-Domain Security Management Server
• Scalable Platforms
• Security Gateway
• Security Management Server

If you run Check Point gateways or management infrastructure, assume exposure until the hotfix confirms otherwise.

Can you mitigate without patching?

Yes, awkwardly. For teams that cannot deploy the hotfixes immediately, Check Point advises stopping the dynamic_server process and preventing it from restarting. It is a temporary measure, and temporary measures have a way of becoming permanent, so calendar the follow-up.

The company also published indicators of compromise. Three checks matter most: commands commonly tied to exploitation attempts; any use of the system() sink, which is uncommon or absent in legitimate traffic; and commands that bypass the default Clish wrapper. That last one signals execution as root straight through the socket and warrants further investigation.

Is this an isolated incident?

It is not. In September, Check Point disclosed two more zero-days — CVE-2026-93616 in Security Management Server and CVE-2026-85102 in Security Gateway — both critical remote code execution flaws that required no privileges on the target system. Over the past two years, CISA has added five Check Point vulnerabilities to its actively exploited catalog. Ransomware gangs have abused two of them.

What does this change for security teams running Check Point gear? It confirms that perimeter appliances themselves are the target, not just the traffic they inspect. Gateways with root-level daemons on unauthenticated sockets are high-value real estate, and the Ivanti-linked tooling suggests one crew is working the segment methodically.

Apply the hotfixes today. Kill dynamic_server if you cannot. Then check the socket logs for commands that never went through Clish — that is where the two dozen victims' stories started.