Check Point patches exploited Gaia OS flaw granting root (CVE-2026-123039)
Original title: Check Point warns of zero-day flaw exploited for root access
Check Point says a couple of dozen customers were hit since late October, with webshells, backdoors, and an ESXi wiper following.
Check Point released emergency hotfixes for CVE-2026-123039, a high-severity local privilege escalation in the Gaia OS DynamicCLI daemon. The root process listens on the world-writable socket /tmp/dynamic_socket without authenticating local users. After Mobile Access portal access via PHP2Shell, attackers dropped webshells and TSGA and TSProxy, then pivoted to a VMware ESXi host and deployed wiper malware. Teams that cannot patch immediately can stop dynamic_server.
Unconfirmed: The article does not name affected builds or the hotfix version strings.
- An authenticated local user can have commands executed as root through the socket.
- Affected products include Firewall, Security Gateway, and Security Management Server.
- TSGA and TSProxy were previously seen in attacks on Ivanti appliances.
- Stopping dynamic_server and blocking its restart is the temporary mitigation.
Impact: Local root command execution and persistence on gateways
| Product | Affected |
|---|---|
| Check Point Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway, and Security Management Server | — |
- 1.Deploy the CVE-2026-123039 emergency hotfixes.
- 2.If patching is delayed, stop dynamic_server and prevent it from restarting.
- 3.Hunt for non-default Clish commands, system() sink use, and published IOCs.
- CVEs
- CVE-2026-123039
- ATT&CK
- T1068 Exploitation for Privilege EscalationT1190 Exploit Public-Facing ApplicationT1505.003 Web ShellT1485 Data Destruction
- Vendors
- Check Point
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-123039 | Local root command execution via Gaia OS DynamicCLI socket | 7.8 | 1% | KEV | KEV |
From the original article
2 min read at bleepingcomputer.com
Check Point Software has released emergency hotfixes to address a high-severity flaw that hackers have been exploiting to gain root privileges and establish persistence on vulnerable devices since late October. [...]
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.