Check Point has disclosed CVE-2026-123039, a vulnerability in Gaia OS, the operating system used on its security gateways and management servers, that lets a local user gain root privileges, and has released Jumbo Hotfixes that fix it. The company's support article (sk1000362) was created on November 8 and last updated on November 12. Check Point says it has observed attacks exploiting the flaw and is urging customers to patch quickly.
Unauthenticated Socket Runs Any Command as Root
According to Check Point's support article, the problem lies in Gaia OS's DynamicCLI mechanism. A process called dynamic_server, which runs as root, accepts commands on a socket at /tmp/dynamic_socket. That socket is created world-writable (0777) and does not authenticate connecting processes, so any command string it receives is executed as root.
The flaw carries a CVSS score of 7.8. To exploit it, an attacker must already be able to run code on the appliance. On its own it is not a flaw that lets someone take over a device directly from outside, but combined with other vulnerabilities it allows an intruder to take full control of the appliance.
R81 Through R82.20 Affected, No Fix Listed for R81.10 and R81
Affected products are Security Gateway, Security Management Server, Multi-Domain Security Management, Check Point Firewall, and Scalable Platforms. Affected versions are R82.20, R82.10, R82, R81.20, R81.10, and R81. Spark Firewalls and Smart-1 Cloud are not affected.
The fix is included in the following Jumbo Hotfix Accumulator releases and later.
| Version | Jumbo Hotfix with the fix |
|---|---|
| R82.20 | Take 14 and later |
| R82.10 | Take 52 and later |
| R82 | Take 132 and later |
| R81.20 | Take 174 and later |
No fix is listed for R81.10 and R81, which have reached end of support. Organizations still running them will need to move to a supported version.
As a temporary measure for customers who cannot apply the fix right away, Check Point describes how to stop the dynamic_server process and keep it from restarting. Doing so, however, disables DynamicCLI commands. After patching, customers can confirm the fix by checking that /tmp/dynamic_socket has 0660 permissions (owner root, group config).
Attacks Chained With Other Vulnerabilities
The support article states that "Check Point observed an active exploit of this vulnerability against a couple of dozen customers."
The attack chain is described in detail in an analysis published by Check Point Research on November 12. According to it, attackers first broke into Mobile Access portals using vulnerabilities dubbed "PHP2Shell" (CVE-2026-109618 and CVE-2026-109619), then gained root through CVE-2026-123039. They then planted web shells in the portal, installed a backdoor called TSGA and malware called TSProxy, moved over SSH to a VMware ESXi host, and ran a wiper that destroys data.
The analysis identifies two waves of attacks. The October 30 wave mainly targeted organizations in Israel, while the November 2 wave spread across several countries. Check Point Research says attribution of the attackers is uncertain.
Customers Should Patch and Check for Compromise
Organizations running Check Point products should first check the version and Jumbo Hotfix level of their appliances and install at least the fixed releases listed in the table above.
The support article also explains how to look for signs of compromise. The DynamicCLI daemon logs the commands it receives to /var/log/dynamicCli.log, and Check Point recommends checking it for commands that did not come through the normal path and for commands commonly used in attacks, such as id, whoami, curl, wget, and useradd. Organizations with Mobile Access enabled would also do well to compare their systems against the indicators of compromise (IoCs) in Check Point Research's analysis.
Our Take
Taken on its own, this vulnerability is a local privilege escalation with a CVSS score of 7.8. In practice, though, it was chained with a separate flaw that provides outside access, and the attacks reportedly went as far as using perimeter appliances as a foothold to destroy virtualization infrastructure. We see this as another reminder that security appliances at the network edge can themselves become the way in. Rather than deprioritizing it based on the score alone, the safer course is to treat it as an exploited vulnerability and address it promptly.
Summary
Check Point has fixed CVE-2026-123039, a root privilege escalation flaw in Gaia OS's DynamicCLI, and said it has observed the flaw being exploited. Jumbo Hotfixes with the fix are available for R82.20 through R81.20, while no fix is listed for R81.10 and R81, which have reached end of support. Customers need to apply the fix promptly and check their logs for signs of compromise.
