Check Point Gaia OS DynamicCLI local privilege escalation zero-day exploited for root access (CVE-2026-123039)
Severity: high · Patch status: patched · Since 2026-11-13 · CVE-2026-123039, CVE-2026-85102, CVE-2026-93616
Check Point released emergency hotfixes for CVE-2026-123039, a high-severity local privilege escalation flaw in the Gaia OS DynamicCLI IPC interface. The dynamicserver daemon runs as root and listens on a world-writable unauthenticated local socket (/tmp/dynamicsocket), letting an authenticated local user execute commands as root. Attackers exploited the flaw against a couple dozen customers since late October, chaining it with the PHP2Shell Mobile Access portal vulnerability to gain root, then dropping webshells and TSGA backdoor/TSProxy malware (previously seen in Ivanti attacks), pivoting to VMware ESXi hosts and deploying wiper malware. Affected products include Firewall, Security Gateway, Security Management Server, Multi-Domain Security Management Server, and Scalable Platforms. Hotfixes are available; temporary mitigation is stopping the dynamicserver process. IOCs provided.
What to do
- Deploy the CVE-2026-123039 hotfixes immediately on all affected Check Point appliances
- If hotfixing is not immediately possible, stop the dynamic_server process and prevent it from restarting as a mitigation
- Check for indicators of compromise: commands associated with exploitation, use of the system() sink, and commands bypassing the default Clish wrapper
- Review Mobile Access portal logs for PHP2Shell exploitation and check for webshells, TSGA backdoor, and TSProxy malware
- Audit connected VMware ESXi hosts for signs of compromise or wiper malware
- Restrict local shell access to Check Point gateways to trusted administrators only
Sources
All live incidents on Threat Watch
