CVE-2026-123039 and the DynamicCLI IPC
Check Point has released emergency hotfixes to remediate CVE-2026-123039, a high-severity local privilege escalation vulnerability in the Gaia OS DynamicCLI daemon (dynamic_server). The DynamicCLI IPC interface accepts privileged command requests; the daemon runs as root and listens on a world-writable local socket at /tmp/dynamic_socket without authenticating connecting processes. That configuration allows an authenticated local user to send a command to the socket and have it executed with root privileges.
Observed exploitation and the multi-stage attack chain
According to Check Point, operators used the flaw in active attacks beginning in late October. In a separate report the company detailed the chain: attackers first gained access to the Mobile Access portal by exploiting a PHP2Shell vulnerability, then escalated privileges to root via CVE-2026-123039 zero-day exploits. After obtaining root, the adversaries dropped webshells and installed a TSGA backdoor and TSProxy malware — tools Check Point previously observed while investigating attacks against Ivanti appliances. From the compromised gateway the attackers pivoted to a VMware ESXi host and deployed destructive wiper malware.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildProducts affected, hotfixes, and interim mitigations
Check Point lists multiple product families as vulnerable to exploitation that leverages CVE-2026-123039: Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway, and Security Management Server. The company released emergency hotfixes for the flaw and advised customers who cannot deploy updates immediately to stop the dynamic_server process and prevent it from restarting as a temporary mitigation.
Check Point also published indicators of compromise (IOCs) and guidance for detection. Customers are urged to examine logs for commands commonly associated with exploitation, the use of the system() sink (which the company says is uncommon or absent in legitimate traffic for these appliances), and commands that bypass the default Clish wrapper — a telltale sign the command was executed as root through the socket and needs further investigation.
Related zero-days and CISA activity
The CVE-2026-123039 incident follows earlier exploitation of Check Point products. In September, Check Point warned customers that attackers had been exploiting two other critical zero-day remote-code-execution vulnerabilities — CVE-2026-93616 in Security Management Server and CVE-2026-85102 in Security Gateway — in attacks that did not require prior privileges on the targeted systems. Over the last two years, the US Cybersecurity and Infrastructure Security Agency (CISA) has added five Check Point flaws to its catalog of actively exploited vulnerabilities; Check Point notes that two of those have also been abused by ransomware gangs.
What this means for security teams, affected enterprises, and CISA
- Security teams: Deploy the vendor hotfixes for CVE-2026-123039 without delay, or implement the temporary mitigation of stopping dynamic_server and preventing its restart; hunt for the IOCs Check Point provided, focusing on system() calls and commands that bypass Clish.
- Affected enterprises and procurement leads: Review exposures of Mobile Access portals and gateways, and verify whether any upstream pivots (for example to VMware ESXi hosts) could have occurred; prioritize remediation for Firewall, Security Gateway, Security Management Server, Multi-Domain Security Management Server, and Scalable Platforms named by Check Point.
- CISA and regulators: The inclusion of multiple Check Point flaws in CISA's actively exploited catalog and the recent string of zero-days reinforce the agency's existing tracking and advisory role for these appliances; coordination on disclosure and patch adoption timelines remains an actionable lever.
Check Point's account ties a local privilege-escalation bug to a stark operational consequence: an authenticated local foothold that can be elevated to root, used to deploy persistent backdoors and malware, and then leveraged to pivot to virtualization infrastructure where destructive wipers can be launched. The vendor's emergency hotfixes and interim mitigation give customers immediate technical steps; the broader sequence of attacks — from PHP2Shell access to post-exploitation implants and ESXi compromise — illustrates why both rapid patching and targeted IOC hunts are now required.
