Check Point CVE-2026-123039: root via DynamicCLI, exploited in destructive gateway attacks

Check Point shipped emergency hotfixes for CVE-2026-123039, a Gaia OS local privilege escalation that hands an attacker root on a firewall, management server, or Maestro orchestrator. On its own it is a local bug — you need code execution on the appliance first. In the field it was not on its own: attackers used the PHP2Shell flaws to land on the Mobile Access portal, used this one to become root, and then wiped a virtualization host. CISA added it to the Known Exploited Vulnerabilities catalog the same day with a three-day federal deadline and a forensic-triage requirement.

Developing story — first published 19:50 CET (18:50 UTC), November 13, 2026. Updated as the vendor and CISA publish more.

At a glance

CVE	CVE-2026-123039
Product / affected versions	Check Point Gaia OS — Security Gateway ("Force" firewalls), Management and Log Servers, Multi-Domain Security Management and Log Server, Maestro Orchestrator; Gaia R82.20, R82.10, R82, R81.20 and the end-of-support R81.10 / R81. Not affected · Spark firewalls, Smart-1 Cloud
Fixed in	Jumbo Hotfix Accumulator — R82.20 from Take 14 · R82.10 from Take 52 · R82 from Take 132 · R81.20 from Take 174. No fix for end-of-support R81.10 / R81
CVSS	7.8 HIGH · CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · scored by Check Point (CNA); NVD status "Awaiting Analysis", not yet scored
Exploited in the wild	Yes — Check Point observed active exploitation against "a couple of dozen" customers; destructive wave from October 30, 2026
CISA KEV	Added 2026-11-13; federal due date 2026-11-16 (BOD 26-04, forensic triage required)
Public PoC	None public as of 2026-11-13
Official advisory	Check Point sk1000362

What CVE-2026-123039 actually is

Gaia OS runs a daemon, dynamic_server, that backs the DynamicCLI command interface. It runs as root and listens on a local Unix socket, /tmp/dynamic_socket. The socket is created world-writable — mode 0777 — and the daemon does not authenticate the process that connects to it. Any local user who can reach that socket can send a command and have it executed as root. That is the whole bug: a classic incorrect-permission-assignment plus missing-authorization pair (CWE-732 and CWE-862), scored 7.8 by Check Point as its own CNA, per the NVD record.

Because the attack vector is local (AV:L) and needs an authenticated user (PR:L), this is not an internet-facing door on its own. It is the second rung of a ladder. And in the attacks Check Point describes, the first rung was already in place.

The chain: PHP2Shell to root to wiper

Per SecurityWeek (Ionut Arghire, November 13) and BleepingComputer (Sergiu Gatlan, November 13), both reporting Check Point's own research, the operation ran like this:

• Initial access through PHP2Shell — the PHP interpreter RCE pair CVE-2026-109618 and CVE-2026-109619, patched October 21, which we covered in our PHP2Shell write-up. The entry point was the gateway's Mobile Access portal.
• Privilege escalation to root with CVE-2026-123039.
• Persistence: PHP webshells dropped into a directory the Mobile Access portal uses to build its login pages, then the TSGA backdoor and TSProxy — variants of the PhiliKit framework previously seen in the China-linked UNC5221 intrusions into Ivanti appliances.
• Impact: internal asset discovery, lateral movement to a VMware ESXi host, and a wiper executed on it.

An appliance you bought to sit at the edge and watch the network became the launch point for destroying a virtualization host behind it. The version string on the box told you which Take you were running. It did not tell you a wiper had already been staged two hops away.

Check Point distinguishes two waves: a destructive wave from October 30 against Israeli organizations, and a second wave from November 2 across several countries with no destructive activity observed. It says it cannot attribute the campaign with confidence — the actor worked typical Chinese business hours, but the wiper and the destruction "do not align with known Chinese cyber operations," leaving an initial-access-broker or false-flag reading open.

Remediation

1. Am I affected?

In Clish, confirm the Gaia version (show version all) and the installed Jumbo Hotfix Accumulator Take, then compare against the fixed Takes below. In Expert mode, check whether the vulnerable daemon is present and running — this command is from the advisory:

ps auxw | grep -v grep | grep 'dynamic_server'

Spark firewalls and Smart-1 Cloud are not affected. R81.10 and R81 are end-of-support and have no fix.

2. Patch — exact fixed Takes

Install the Jumbo Hotfix Accumulator at or above the listed Take for your branch (from sk1000362):

Gaia branch	Fixed from
R82.20	Take 14
R82.10	Take 52
R82	Take 132
R81.20	Take 174
R81.10 / R81 (EOS)	No fix — migrate to a supported branch

3. Can't patch now? Compensating controls

The advisory's stopgap is to stop the dynamic_server process and keep it from restarting via the documented dbset commands — note that this disables the Dynamic CLI features described in sk144112, so weigh the operational cost. Use the exact commands as published in sk1000362.

The more important point: this escalation only fires after an attacker already has local code execution. In the observed campaign that came from PHP2Shell on the Mobile Access portal. Closing that door is itself a compensating control — confirm the PHP2Shell patch (CVE-2026-109618 / CVE-2026-109619) is applied, and restrict exposure of the Mobile Access portal and management interfaces to the networks that actually need them.

4. Hunt for compromise

KEV flags this entry as forensic-triage-required, which means assume breach until the logs say otherwise. The daemon logs every command it receives to /var/log/dynamicCli.log. Legitimate requests carry a fixed Clish wrapper; anything else is suspect. Check Point's own detection queries:

grep "Received =" /var/log/dynamicCli.log \
  | grep -vF "CPprofile.sh >> /dev/null; export SP_DISTRIBUTE=0; set -o noglob;"
grep -F "Received = #return_value#" /var/log/dynamicCli.log
grep -EI "Received =.*( id;| whoami| /etc/shadow| ncat| nc -| /dev/tcp| curl | wget | base64| useradd| authorized_keys)" /var/log/dynamicCli.log

Beyond the socket: webshells in the Mobile Access login-page directory, the TSGA / TSProxy implants, unexpected gateway-to-ESXi connections, and the full IOC set Check Point published with its research report. Mapped to MITRE ATT&CK: T1190 (exploit public-facing application — PHP2Shell), T1068 (exploitation for privilege escalation — this CVE), T1505.003 (web shell), T1021 (lateral movement), T1041/T1071 (C2 over the TSProxy channel), T1485 (data destruction — the wiper).

5. Eradicate and verify

Where the hunt finds hits, patching is not enough — persistence and a backdoor were installed, so rebuild the affected appliance from known-good media, remove webshells and implants, and rotate every credential and key the box held (admin, SIC, API, any secret reachable from root). After patching, confirm the socket is no longer world-writable — it should show srw-rw---- root config (0660), not 0777 — and that blocked escalation attempts now appear as Rejected connection from unauthorized uid lines in dynamicCli.log. Verify the fix by re-running the chain against the appliance, not by reading the version string.

What is not known yet

• NVD score and analysis. NVD still lists the record as "Awaiting Analysis"; the 7.8 is Check Point's own score. NVD may adjust it.
• Hotfix release dates. The advisory names the fixed Takes but does not publish their release timestamps; confirm the Take you install is current.
• Attribution. Check Point explicitly declines a high-confidence call. Business-hours overlap points one way, the wiper points another.
• Full scope. "A couple of dozen customers" is Check Point's count of observed exploitation, not a ceiling. The forensic-triage requirement exists because the quiet victims have not all reported in.

Where this leaves defenders

The honest question a Check Point operator is asking tonight is not "which Take am I on" — it is "could someone actually get from my Mobile Access portal to root on this box and onward to my ESXi." A version scan answers the first and dodges the second. The only answer to the second is to run the chain.

That is what an autonomous AI red team does, and it is the primary case Zero Hunt is built for. The 10-agent swarm reproduces exactly this path — a Web and Exploit agent land the foothold, a Post-Exploit agent drives the local escalation, a Pivot agent tests the reach from the gateway into the virtualization layer — against your own appliance, gray-box, with every exploit running in an ephemeral hardened container that never touches the appliance host. It runs on-premise on private models, so pointing the engine at a firewall that holds your SIC and management credentials never ships those to a third party, and a human approves every action that matters. It tells you whether your R81.20 on Take 170 is drivable to root, not merely that it is below Take 174. For the "patch, or stop the daemon, and in what order" decision, the Remediation Advisor ranks by real exploitability — CISA KEV first, then what the campaign actually proved reachable — and re-verifies the fix with the same proof that demonstrated the hole.

And the part the version string never showed — the wiper staged two hops away — is a traffic problem. A couple of dozen customers ran compromised gateways for roughly two weeks. The lateral move to ESXi, the TSProxy channel, the staging before the wipe: all of it is loud on the wire. Zero Hunt's traffic-analysis model, with four inference heads running on the appliance GPU, baselines what a gateway normally talks to and flags the firewall reaching for an ESXi host it has no business touching — while it is happening, not in the next morning's SIEM digest.

CVE-2026-123039 is a three-day KEV clock. If you run Check Point gateways, the full fix-and-hunt runbook above, our PHP2Shell analysis, and the BOD 26-04 risk-based patching guide are where to start; if you are deciding how to validate edge appliances continuously rather than once a year, see our guide to automated penetration testing. Questions on validating your own estate: talk to us.