Check Point CVE-2026-123039 Exploited for Local Root Access

• •CVE-2026-123039 allows local privilege escalation to root on Gaia OS.
• •Active exploitation confirmed since late October; attackers initially gain access via PHP2Shell.
• •Immediate patching or disabling of the dynamic_server process is recommended.

Check Point Software has issued emergency hotfixes for CVE-2026-123039, a high-severity local privilege escalation vulnerability affecting Gaia OS. The flaw allows authenticated local users to execute arbitrary commands as root via a world-writable socket (/tmp/dynamic_socket) used by the DynamicCLI daemon. Active exploitation has been confirmed since late October, with attackers leveraging this vulnerability to gain root access after initially compromising devices through the PHP2Shell vulnerability. Affected products include various Check Point firewalls and management servers. Check Point advises immediate application of the hotfix or, if that is not possible, to disable the dynamic_server process as a temporary measure. Indicators of compromise (IOCs) have been shared to help organizations identify potential exploitation attempts. The vulnerability has been added to CISA's KEV list as of November 13, 2026.