Introduction
Check Point Software has released emergency hotfixes to address a high-severity flaw that hackers have been exploiting to gain root privileges and establish persistence on vulnerable devices since late October. The vulnerability, tracked as CVE-2026-123039, was found in the DynamicCLI IPC interface used to send privileged command requests to the root-level Gaia OS DynamicCLI daemon. The vulnerability was actively exploited against a couple of dozen customers, and Check Point advised security teams to stop the dynamic_server process and prevent it from restarting as a temporary mitigation measure. The company also shared indicators of compromise (IOCs) and advised customers to check for commands commonly associated with exploitation attempts, the use of the system() sink, and commands that don't use the default Clish wrapper.
Vulnerability Details
The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root. The vulnerability affects Check Point's Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway, and Security Management Server products. Check Point observed an active exploit of this vulnerability against a couple of dozen customers. The attackers first gained access to the Mobile Access portal by exploiting the PHP2Shell vulnerability, then escalated privileges to root using CVE-2026-123039 zero-day exploits. Next, the threat actors dropped webshells and installed TSGA backdoor and TSProxy malware that was previously spotted while investigating attacks targeting Ivanti appliances, then pivoted from the compromised gateway to a VMware ESXi host and deployed destructive wiper malware.
Additional Context
In September, Check Point warned customers that attackers had been exploiting two other critical Security Management Server (CVE-2026-93616) and Security Gateway (CVE-2026-85102) remote code execution (RCE) vulnerabilities in zero-day attacks that didn't require privileges on the targeted systems. Over the last two years, the US Cybersecurity and Infrastructure Security Agency (CISA) has added five Check Point flaws to its catalog of actively exploited vulnerabilities, two of which have also been abused by ransomware gangs.
Recommendations
Check Point advised security teams who can't immediately deploy the CVE-2026-123039 hotfixes to stop the dynamic_server process and prevent it from restarting as a temporary mitigation measure. The company also shared indicators of compromise (IOCs) and advised customers to check for commands commonly associated with exploitation attempts, the use of the system() sink, and commands that don't use the default Clish wrapper. Customers can find evidence of compromise by checking for commands commonly associated with exploitation attempts, the use of the system() sink, and commands that don't use the default Clish wrapper (indicating that it was executed as root through the socket and requires further investigation).
Related Threats
In September, Check Point warned customers that attackers had been exploiting two other critical Security Management Server (CVE-2026-93616) and Security Gateway (CVE-2026-85102) remote code execution (RCE) vulnerabilities in zero-day attacks that didn't require privileges on the targeted systems. Over the last two years, the US Cybersecurity and Infrastructure Security Agency (CISA) has added five Check Point flaws to its catalog of actively exploited vulnerabilities, two of which have also been abused by ransomware gangs.
Conclusion
Check Point's emergency hotfixes address a high-severity vulnerability that attackers have been exploiting since October to gain root privileges and establish persistence on vulnerable devices. The vulnerability affects Check Point's Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway, and Security Management Server products. Check Point advised security teams to stop the dynamic_server process and prevent it from restarting as a temporary mitigation measure. The company also shared indicators of compromise (IOCs) and advised customers to check for commands commonly associated with exploitation attempts, the use of the system() sink, and commands that don't use the default Clish wrapper. Customers can find evidence of compromise by checking for commands commonly associated with exploitation attempts, the use of the system() sink, and commands that don't use the default Clish wrapper (indicating that it was executed as root through the socket and requires further investigation).
Comments