Check Point warns of zero-day flaw exploited to gain root access | Межа

Attackers have been exploiting the flaw since late October to gain root privileges and maintain access to vulnerable Check Point devices.

Check Point has released emergency hotfixes for the high-severity vulnerability, tracked as CVE-2026-123039. The company said it had observed active exploitation against a couple of dozen customers.

This is reported by BleepingComputer .

The local privilege escalation flaw affects the DynamicCLI IPC interface, which sends privileged command requests to the root-level Gaia OS DynamicCLI (dynamic_server) daemon. The daemon listens on a world-writable local socket, /tmp/dynamic_socket, without authenticating connecting processes. An authenticated local user can send a command through the socket and have it run as root.

Vulnerable products include Check Point Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway and Security Management Server.

In a separate report, Check Point said the attackers first accessed the Mobile Access portal by exploiting the PHP2Shell vulnerability, then used CVE-2026-123039 zero-day exploits to escalate privileges to root. They dropped webshells, installed the TSGA backdoor and TSProxy malware, moved from the compromised gateway to a VMware ESXi host and deployed wiper malware.

Check Point advised security teams unable to deploy the hotfixes immediately to stop the dynamic_server process and prevent it from restarting as a temporary mitigation. The company also shared indicators of compromise, including commands commonly associated with exploitation, use of the system() sink, and commands that bypass the default Clish wrapper. It said the latter may indicate execution as root through the socket and requires further investigation.

We recommend paying attention to:

Microsoft warns of active zero-day attacks targeting SharePoint servers used by governments and businesses, urging urgent security updates to prevent data breaches.

A Pentagon personnel system breach exposed unencrypted personal records of 2.8 million living people and nearly 300,000 deceased, including Social Security numbers and military service details.