Check Point Software has released emergency hotfixes for a high-severity local privilege escalation vulnerability that attackers have been exploiting since late October. The flaw, tracked as CVE-2026-123039, affects the DynamicCLI inter-process communication interface used to send privileged commands to the root-level Gaia OS DynamicCLI (dynamic_server) daemon. Check Point said it observed active exploitation against a couple of dozen customers.

How the flaw works

According to the company’s advisory, the dynamic_server daemon runs as root and listens on a world-writable local socket at /tmp/dynamic_socket without authenticating connecting processes. An authenticated local user can send a command to that socket and have it executed with root privileges. Because the attacker must already hold a local foothold, the flaw is best understood as a privilege escalation step within a larger intrusion.

Affected products

The advisory lists the following Check Point products as vulnerable: Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway, and Security Management Server.

Observed attack chain

In a separate report, Check Point described an intrusion in which attackers first reached the Mobile Access portal by exploiting the PHP2Shell vulnerability. They then escalated to root using the CVE-2026-123039 zero-day. From there, the actors dropped webshells and installed TSGA backdoor and TSProxy malware, previously seen in campaigns against Ivanti appliances. The attackers then pivoted from the compromised gateway to a VMware ESXi host and deployed destructive wiper malware.

Mitigation and detection

  • Apply the Check Point hotfixes as soon as possible.
  • If immediate patching is not possible, stop the dynamic_server process and prevent it from restarting as a temporary measure.
  • Review logs for commands commonly associated with exploitation, use of the system() sink, which is uncommon or absent in legitimate traffic, and commands that bypass the default Clish wrapper, which may indicate root execution through the socket.
  • Consult the indicators of compromise published by Check Point.

Context

Earlier this year, Check Point warned that attackers had been exploiting two other vulnerabilities, a Security Management Server flaw (CVE-2026-93616) and a Security Gateway flaw (CVE-2026-85102), in zero-day remote code execution attacks that required no privileges on the target. Over the past two years, the US Cybersecurity and Infrastructure Security Agency has added five Check Point flaws to its catalog of actively exploited vulnerabilities, two of which have also been abused by ransomware groups.