Check Point Gaia CVE-2026-123039: Exploited DynamicCLI Root Escalation Added to CISA KEV — Patch Now

Check Point has fixed CVE-2026-123039, a local privilege escalation flaw in the Gaia OS DynamicCLI service. It affects Check Point Security Gateways (Force Firewalls), Management and Log Servers, Multi-Domain Security Management and Maestro Orchestrator. According to Check Point, the root-owned dynamic_server process listens on a world-writable local socket and runs any command it receives "as root". Check Point, as the CNA, scores it CVSS 3.1 7.8 High (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on 13 November 2026.

In sk1000362, Check Point says it "observed an active exploit of this vulnerability against a couple of dozen customers". In those incidents, attackers first broke in through PHP2Shell (CVE-2026-109618 and CVE-2026-109619) on the Mobile Access portal, then used CVE-2026-123039 to get root. The flaw is local only, so an attacker needs code execution on the appliance first. Check Point says a hotfix for PHP2Shell was available on 23 October, a week before the attacks, and that "only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents." The fix for CVE-2026-123039 itself ships in the November Jumbo Hotfix. Organizations running Check Point gateways or management servers should install the November Jumbo Hotfix now, starting with internet-facing Mobile Access gateways.

Technical Information

Check Point's sk1000362 describes the flaw. Gaia's dynamic (extended) CLI is served by a root process, dynamic_server, which listens on the local socket /tmp/dynamic_socket. On affected versions, the socket is created world-writable (0777) and does not authenticate the connecting process. As a result, "any authenticated local user can run arbitrary commands as root by writing a single request to the socket." Check Point stresses that the issue "requires the attacker to already have local code execution on the appliance." The CVE.org record, published by Check Point on 12 November 2026, assigns CWE-862 (Missing Authorization) and CWE-732 (Incorrect Permission Assignment for Critical Resource).

How it was exploited. Check Point Research's technical write-up and the company's security advisory blog describe the chain:

1. Initial access through PHP2Shell on the Mobile Access portal of unpatched Security Gateways. Check Point scores PHP2Shell 9.2 and covers it in sk1000302.
2. Root through CVE-2026-123039, escalating from the portal service account.
3. Persistence through PHP webshells and a backdoor Check Point Research calls TSGA, with an embedded networking component, TSProxy.
4. In some cases, destruction. Check Point Research says that in the investigated intrusion, the attackers moved from the gateway to a VMware ESXi host over SSH and ran a wiper it calls destroy_v6. The company's blog says destructive activity happened "in a limited number of cases."

Timeline and scope. According to Check Point, exploitation began on 30 October 2026 and was observed until 4 November. Check Point Research says the first wave, on 30 October, targeted Israeli organizations and included destructive activity against some of them. A broader second wave on 2 November targeted organizations in multiple countries and sectors, "with no evidence of destructive activity."

Attribution is unsettled. Check Point Research links TSGA and TSProxy to PhiliKit, a toolset previously reported in attacks on Ivanti appliances. It also says the evidence "does not allow us to assess with high confidence the true nature of this operation."

A second Gaia flaw in the same release. Check Point also fixed CVE-2026-107484 (sk1000291, CVSS 3.1 7.3). It is an authorization flaw in Gaia Portal backend handlers that could let "an authenticated, non-administrative user" perform administrator-only operations. Check Point lists it as not exploited in the wild.

Exploitation and KEV. CVE-2026-123039 is in the CISA KEV catalog (dateAdded 13 November 2026, dueDate 16 November 2026 for US federal civilian agencies; known ransomware use "Unknown"; catalogVersion 2026.11.13, checked 14 November 2026 at 08:15 Asia/Jerusalem). CVE-2026-107484 is not in the KEV catalog. The Canadian Centre for Cyber Security also issued advisory AV26-1154. NVD lists CVE-2026-123039 as Undergoing Analysis, with Check Point's 7.8 as a Secondary score and no NVD Primary score.

Affected Product Versions

Check Point's sk1000362 lists Gaia R82.20, R82.10, R82, R81.20, R81.10 and R81 as affected. Spark Firewalls and Smart-1 Cloud are listed as not affected.

Customers on end-of-support R81.10 or R81 should upgrade to a supported version and use the mitigation below in the meantime. The same Jumbo Hotfix Takes include the PHP2Shell fix (sk1000302) and the CVE-2026-107484 fix. For CVE-2026-107484, sk1000291 lists R82.20 as not affected and fixed in the same R82.10, R82 and R81.20 Takes (the blog's table differs; we follow the SK).

Workaround and Mitigation

Patch. Check Point recommends installing the November Jumbo Hotfix "on all Management Servers and Security Gateways" and says to prioritize internet-facing Mobile Access deployments. After patching, sk1000362 says ls -l /tmp/dynamic_socket should show srw-rw---- root config (0660), not srwxrwxrwx (0777).

Until you can patch, sk1000362 gives a mitigation: stop the dynamic_server process and prevent it from restarting with dbset process:dynamic_server followed by dbset :save. Check Point notes that this causes the Dynamic CLI commands listed in sk144112 to fail. Follow the exact steps in the SK.

Close the door attackers used. CVE-2026-123039 was the second step. If you run the Mobile Access portal or other affected gateway web portals, confirm the PHP2Shell fix from sk1000302 is installed.

Rescana guidance: patching does not undo a compromise that already happened. If a gateway was exposed and unpatched between late October and early November, check it for the signs Check Point describes below before you treat it as clean. Gateways sit at the edge of your network and hold VPN and firewall configuration, so treat any sign of compromise as an incident.

Indicators of Compromise

Check Point has published investigation guidance and indicators; we do not reproduce file hashes.

• Your own logs. sk1000362 says the vulnerable daemon logs every command it receives to /var/log/dynamicCli.log. Any received command that does not use the expected Clish wrapper "may indicate that a command was executed as root through the socket and requires investigation." The SK gives the exact checks. On patched systems, "Rejected connection from unauthorized uid" entries indicate that an escalation attempt was blocked.
• Vendor-listed indicators. Check Point's blog lists two scanning source addresses (130.94.19[.]204 and 130.94.19[.]168), PHP session files containing the string upload_progress_pwn, a process or binary using the naming pattern CPconfigdaemon, scanner or wiper tooling under /tmp or /temp, a ransom-style note referencing "Dream Annexation" with no payment demand, and unexplained gaps in firewall traffic logs.
• Hashes and hunting details are in the Check Point Research write-up.

Check Point says: "Absence of a match does not rule out compromise, and presence of a match warrants immediate investigation."

What to Ask Your Suppliers Today

Ask suppliers, managed security providers and hosting partners that run Check Point gateways or management servers in front of your data or connections:

1. Do you run Check Point Security Gateways, Management Servers, Multi-Domain or Maestro on Gaia R81 through R82.20? Ask which versions.
2. Have you installed the November Jumbo Hotfix? Ask for the Take number and the date. If any system runs R81.10 or R81, ask for the upgrade plan and whether the dynamic_server mitigation is in place.
3. Is the Mobile Access portal exposed to the internet, and when did you install the PHP2Shell fix (sk1000302)? Systems exposed and unpatched in late October carry the most risk.
4. Have you checked /var/log/dynamicCli.log and Check Point's published indicators? Ask whether anything was found and, if so, whether any VPN, firewall or connected systems were affected.

Track incomplete answers to closure.

For the exploited Check Point flaws added to KEV in September, see our advisory on Check Point Security Gateway and Management Server CVE-2026-85102 and CVE-2026-93616.

Need help identifying which of your suppliers run Check Point gateways and tracking whether they have patched CVE-2026-123039? Our team can help you prioritize them and track their answers. Talk to an expert

Sources

• Check Point sk1000362: description, affected versions, mitigation, indicators and fixes (last modified 12 November 2026).
• Check Point blog: Security Advisory: Active Exploitation of PHP2Shell and Local Privilege Escalation: scope, timeline, vulnerability table and indicators.
• Check Point Research: PHP2Shell Exploitation on Check Point Gateway: 12 November 2026; attack chain, attribution and IOCs.
• Check Point sk1000291: CVE-2026-107484.
• Check Point sk1000302: PHP2Shell hotfix.
• CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog: 13 November 2026.
• CISA KEV catalog entry for CVE-2026-123039: dateAdded 13 November 2026, dueDate 16 November 2026.
• Canadian Centre for Cyber Security AV26-1154: 12 November 2026, updated 13 November 2026.
• CVE.org record for CVE-2026-123039: Check Point CNA; published 12 November 2026.
• NVD record for CVE-2026-123039: Undergoing Analysis.