Can someone exploit CVE-2026-123039 without logging in?

Not directly. It is a local privilege escalation, so the attacker needs an authenticated local user first. In the observed attacks, they got in through the Mobile Access portal using the PHP2Shell vulnerabilities.

Is stopping dynamic_server a permanent fix?

No. Check Point describes it as a temporary mitigation for teams that can't deploy the hotfix right away. You must also prevent the process from restarting, and you should still install the hotfix.

How do I know whether my gateway was already compromised?

Compare your logs against Check Point's published indicators of compromise. Look for commands tied to exploitation attempts, use of the `system()` sink, and commands that skip the default Clish wrapper.

Why does a gateway compromise put VMware ESXi hosts at risk?

A gateway sits on the network path to internal systems. In the reported attacks, the actors pivoted from the compromised gateway to an ESXi host and deployed destructive wiper malware.

Has Check Point had other exploited flaws recently?

Yes. In September it warned about exploited RCE flaws in Security Management Server (CVE-2026-93616) and Security Gateway (CVE-2026-85102). CISA has also added five Check Point flaws to its exploited-vulnerabilities catalog over the last two years.

Check Point warns of zero-day flaw exploited for root access

What happened

Check Point has released emergency hotfixes for a high-severity flaw that attackers have used to gain root privileges and persist on vulnerable devices since late October. The bug is tracked as CVE-2026-123039. BleepingComputer reported it on November 13, 2026.

The flaw is a local privilege escalation in the DynamicCLI IPC (Inter-Process Communication) interface. That interface sends privileged command requests to the root-level Gaia OS DynamicCLI daemon, dynamic_server.

Check Point explains the cause in its advisory: the daemon runs as root and listens on a world-writable local socket, /tmp/dynamic_socket, without authenticating connecting processes. An authenticated local user can send a command to the socket and have it run as root.

Who is affected

The vulnerable Check Point products include:

Firewall
Multi-Domain Security Management Server
Scalable Platforms
Security Gateway
Security Management Server

The flaw sits in Gaia OS, so check every gateway and management server you run from this list. The exact fixed builds are in Check Point's advisory, so match your version against it before you close the ticket.

How serious it is and how attackers used it

This is exploited in the wild. Check Point said it "observed an active exploit of this vulnerability against a couple of dozen customers."

The flaw needs a local, authenticated foothold. That makes it a second-stage bug, and the attack chain shows why that still matters. In a separate report, Check Point said the attackers:

Gained access to the Mobile Access portal by exploiting the PHP2Shell vulnerabilities.
Escalated to root with CVE-2026-123039 zero-day exploits.
Dropped webshells and installed the TSGA backdoor and TSProxy malware. Both were previously seen in attacks on Ivanti appliances.
Pivoted from the compromised gateway to a VMware ESXi host and deployed destructive wiper malware.

A root-level compromise of a perimeter gateway can therefore lead to the virtualization layer behind it. Treat a hit on this flaw as a possible full incident, not just a patching task.

This is also not Check Point's first exploited zero-day this year. In September the company warned that attackers had exploited two critical RCE flaws, CVE-2026-93616 in Security Management Server and CVE-2026-85102 in Security Gateway, without needing privileges. Over the last two years, CISA has added five Check Point flaws to its catalog of actively exploited vulnerabilities. Two of those have also been abused by ransomware gangs.

What to do now

1. Patch first

Install the emergency hotfix for CVE-2026-123039 on every affected gateway and management server. Start with internet-facing gateways, especially any with the Mobile Access portal enabled.

2. Mitigate if you can't patch yet

Check Point's temporary measure is to stop the dynamic_server process and prevent it from restarting. Use the method in the vendor advisory so the change survives a reboot. Then confirm the daemon is really gone.

3. Check exposure on the device

From an expert-mode shell, these read-only commands show whether the daemon is running and what the socket permissions look like:

ps -ef | grep '[d]ynamic_server'
ls -l /tmp/dynamic_socket

If the process is running or the socket exists, the device is still exposed until you patch or mitigate.

4. Hunt for evidence of compromise

Check Point says you can find evidence of compromise by looking for:

Commands commonly associated with exploitation attempts.
Use of the system() sink, which is uncommon or absent in legitimate traffic.
Commands that don't use the default Clish wrapper. That suggests they ran as root through the socket and need further investigation.

Check Point has also published indicators of compromise (IOCs). Compare them against your logs, and look for the TSGA and TSProxy malware and unexpected webshells.

Triage checklist

Situation	Action
Hotfix applied, no suspicious commands found	Keep monitoring and record the patch date
Not patched, mitigation applied	Confirm `dynamic_server` is stopped, then schedule the hotfix
Suspicious non-Clish commands or IOC match	Treat as compromised, isolate the device, and check the ESXi hosts behind it
Mobile Access portal exposed and unpatched	Raise the priority, because this was the entry point in the attacks

If you find signs of compromise, don't stop at the gateway. The attackers moved to a VMware ESXi host and deployed wiper malware, so review that host and its backups too.

What learners can take from this

This incident shows why least privilege and authentication on local interfaces matter. A root daemon on a world-writable socket with no authentication turned a small foothold into full control. Learners often study privilege escalation as theory, but here it is the middle step of a real chain that ended in a wiper.

If you want practice reading incidents like this, our SC-200 exam guide covers detection and KQL skills. For a similar recent case, read our write-up of the N-central zero-day exploited hours after a PoC. More study paths are on our cybersecurity certifications page.

Sources

Check Point warns of zero-day flaw exploited for root access (BleepingComputer)