CISA Warns of Actively Exploited Check Point Zero

CISA has reportedly added CVE-2026-123039, a Check Point Gaia OS permission flaw, to its Known Exploited Vulnerabilities catalog following active exploitation. The entry supplied for this report lists November 13, 2026, as the addition date and November 16 as the remediation deadline.

Check Point exploitation reporting nevertheless identifies compromised customers and a practical route from restricted appliance access to root execution.

The flaw resides in dynamic_server , the root-owned process serving Gaia’s DynamicCLI interface. It receives commands through /tmp/dynamic_socket , a local interprocess communication endpoint created with world-writable 0777 permissions.

Check Point Zero-Day Vulnerability Exploited

Because the daemon does not authenticate connecting processes, a locally executing attacker can submit commands that inherit its root privileges.

This local privilege escalation breaks the security boundary between ordinary accounts and privileged services without requiring administrator credentials or additional victim interaction.

Exploitation requires existing local code execution; the socket defect does not independently provide unauthenticated remote access. Attackers have instead chained PHP2Shell exploitation against Mobile Access portals with DynamicCLI command execution.

Reporting associates the initial entry points with CVE-2026-109618 and CVE-2026-109619. After compromising the portal, operators escalated privileges and installed zz*.tpl PHP webshells inside its templates directory, turning an application foothold into control over the underlying security appliance.

Investigators subsequently observed the TSGA backdoor executing as /tmp/CPconfigdaemon before relocating into persistence as slot_CPconfigdaemon .

Its TSProxy component deployed /lib/libcpfwcommon.so and intercepted networking functions within appliance processes. Attackers also conducted internal reconnaissance, accessed VMware ESXi infrastructure through SSH, and executed destructive tooling.

These activities illustrate how root privilege escalation can transform an initial service compromise into persistent access and lateral movement, although the separate Linux kernel issue uses a different exploitation mechanism.

Affected branches include R82.20, R82.10, R82, R81.20, and the end-of-support R81.10 and R81 releases. Impacted deployments span firewalls, management and log servers, Multi-Domain systems, and Maestro Orchestrator.

CISA stated that Spark Firewalls and Smart-1 Cloud are unaffected. Available fixes include R82.20 Take 14, R82.10 Take 52, R82 Take 132, and R81.20 Take 174.

Administrators should prioritize supported vendor updates rather than assume that restricting external management connectivity removes a locally reachable escalation path.

Forensic review should examine /var/log/dynamicCli.log for received commands missing the expected Clish wrapper and requests containing #return_value# .

Investigators should correlate suspicious entries with portal artifacts, unexpected webshells, newly established persistence, and evidence of lateral movement.

These indicators support the investigation but should not be treated individually as conclusive proof of compromise. Patched systems should expose /tmp/dynamic_socket with 0660 permissions and root:config ownership, reject unauthorized callers, and record their user identifiers.

Temporarily stopping dynamic_server blocks this escalation route but disables dependent DynamicCLI functionality. Organizations should follow vendor remediation guidance instead of treating manual socket permission changes as a complete security fix.

Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team

Artificial Intelligence

Cyber security Course

Cyber Security Resources

Cybersecurity

Information Gathering

Information Security Risks

BlackNevas Ransomware Attacks VMware ESXi Servers, Destroying Virtual Machines and Backup Infrastructure

Hackers Use Stolen LLM API Keys to Power ARTEX AI Agents and Continue Credential Theft

FBI Warns Hackers Are Weaponizing ARTEX AI Framework to Launch Autonomous Cyberattacks Worldwide

Hackers Use Falcon C2 Framework to Hijack Browsers and Steal Credentials From Government Agencies

Japan Hit by Record Cyberattack Surge as Hackers Use AI to Exploit Security Vulnerabilities

Uber Hacked – Hackers Steal Drivers’ License Personal Data