Check Point Software has deployed emergency hotfixes to resolve a high-severity privilege escalation vulnerability that threat actors have been actively abusing as a zero-day since late October. The flaw allows attackers who have already established a foothold to gain full root control and maintain persistent access across targeted networking gear.

According to reporting from BleepingComputer, the vendor confirmed that active exploitation campaigns have struck a couple of dozen customer environments. The attacks were part of sophisticated multi-stage intrusions aimed at pivoting deeper into corporate networks.

Flaw in Gaia OS DynamicCLI Socket

The vulnerability, tracked as CVE-2026-123039, resides within the DynamicCLI Inter-Process Communication (IPC) interface inside Check Point's Gaia OS. This component passes privileged command instructions directly to the dynamic_server daemon, which operates with root privileges.

Under default configurations, the daemon listens on a world-writable local Unix socket located at /tmp/dynamic_socket without properly verifying the identity or privileges of connecting processes. Consequently, any authenticated local user or compromised low-privileged service can send raw commands directly to the socket, forcing the daemon to run them as root.

The security issue affects a broad spectrum of enterprise devices running Gaia OS, including Check Point Firewall, Security Gateway, Scalable Platforms, Security Management Server, and Multi-Domain Security Management Server deployments.

Intrusions Lead to Malicious Pivots and Wipers

In attack chains observed by Check Point, the threat actors first obtained an initial foothold on the perimeter by exploiting PHP2Shell vulnerabilities present within the Mobile Access portal. Once initial code execution was established, the attackers deployed exploits for CVE-2026-123039 to escalate privileges to root.

With root-level execution secured on the gateway, the adversaries dropped webshells alongside the TSGA backdoor and TSProxy malware. Both tools were previously identified in attacks aimed at Ivanti edge devices. The intrusion operators subsequently leveraged the compromised gateways to pivot laterally into internal virtualization infrastructure, targeting a VMware ESXi host to execute destructive wiper malware.

The disclosure follows earlier zero-day incidents hitting Check Point infrastructure. In September, the vendor notified customers regarding active attacks targeting two unauthenticated remote code execution bugs affecting Security Management Server (CVE-2026-93616) and Security Gateway (CVE-2026-85102). Over the preceding two years, the Cybersecurity and Infrastructure Security Agency added five Check Point vulnerabilities to its catalog of actively exploited bugs, two of which saw abuse by ransomware syndicates.

Mitigation and Detection Steps

Check Point strongly urges administrators to apply the released emergency hotfixes immediately to neutralize CVE-2026-123039 across all affected appliances. Organizations that cannot immediately patch must implement temporary containment steps.

  • Stop the Vulnerable Daemon: Terminate the active dynamic_server process and take steps to ensure the service does not restart automatically.
  • Inspect Socket Traffic: Review system telemetry for commands sent without the standard Clish wrapper, which indicates direct interaction with the local socket under root context.
  • Analyze Command History: Search logs for invocations of the system() sink, an activity the vendor notes is atypical or nonexistent in normal operational traffic.
  • Review Perimeter Entry Points: Investigate Mobile Access portal logs for signs of PHP2Shell exploitation or unauthorized webshell creation.

Security teams should also review connections between edge firewalls and internal infrastructure, paying special attention to virtualization hypervisors such as VMware ESXi hosts to verify that no secondary persistence or destructive tools have been staged.