Check Point Patches a Root Daemon That Accepts Commands From Any Local Process

TL;DR

• CVE-2026-123039 is a local privilege escalation in Gaia OS, the operating system that runs on Check Point security appliances, where a daemon named dynamic_server executes commands as root.
• The daemon listens on a Unix socket, /tmp/dynamic_socket, and on affected builds that socket is world-writable with no authentication of the process connecting to it, so any local user can ask the appliance to run a command as root.
• Check Point published emergency hotfixes and records an active exploit against a couple of dozen customers, in a single region, with a CVSS score of 7.8 for the flaw itself.
• The socket sits second in a chain: PHP2Shell in the Mobile Access portal reached the appliance first, and the DynamicCLI escalation turned that foothold into root between 30 October and 4 November 2026.
• The activity arrived in two waves, the second one broader and spread across several countries, and Check Point Research records the scanning concentrated between 00:00 and 09:00 UTC.
• The fix ships in four jumbo hotfix takes, and an operator confirms it with two commands: the socket mode reads 0660 after the patch, and the log lists rejected connections from an unauthorized uid.
• A root shell on a security appliance reaches the management plane, the policy, and whatever the gateway can route to, which is why the next steps in this intrusion went to a hypervisor and a wiper.

What the DynamicCLI daemon accepts on a Gaia appliance

Gaia OS carries two command interfaces. The Clish shell is the documented one, and behind it sits an extended CLI served by a process called dynamic_server that runs as root. The advisory describes the interface plainly: the daemon listens on a local Inter-Process Communication socket at /tmp/dynamic_socket, and that socket is created with mode 0777 on affected products, with no authentication of the connecting process.

Read that combination as a permissions statement. A socket with mode 0777 accepts a connection from any account on the box, the daemon runs as root, and it executes whatever command string it receives. Check Point's own wording is that any authenticated local user can run arbitrary commands as root by writing a single request to the socket. The precondition is real and worth stating: the attacker needs local code execution on the appliance first. This flaw converts a limited foothold into full control.

The affected list covers Check Point Force Firewalls, Management and Log Servers, Multi-Domain Security Management and Multi-Domain Log Server, and Maestro Orchestrator, across R81, R81.10, R81.20, R82, R82.10 and R82.20. Spark Firewalls and Smart-1 Cloud sit outside the exposure.

The chain that reached root: PHP2Shell first, then the socket

The intrusion Check Point Research documented started from the network. Initial access came through PHP2Shell in the Mobile Access portal, tracked as CVE-2026-109618 and CVE-2026-109619 at 9.2, which gave code execution in the portal. The DynamicCLI escalation supplied the root.

What happened with root reads as a study in persistence. The researchers describe PHP webshells written into the templates directory the portal uses to build its login pages, launched so a file named zz.tpl carries a command shell that later accepts a hardcoded key and supports operating-system commands, PHP evaluation and file uploads. Then came a standalone backdoor: TSGA, deployed as /tmp/CPconfigdaemon and relaunched as slot_CPconfigdaemon from the boot persistence directory, with an embedded shared library called TSProxy written to /lib/libcpfwcommon.so so selected appliance processes carry the attacker's traffic inside ordinary connections.

The detail that matters for anyone running a gateway is the third stage. With root on the appliance, the attackers ran the gogo scanner to map the internal network, then moved over SSH to a VMware ESXi host using the vpxuser service account and executed a wiper named destroy_v6.

Two waves, several countries, and the hours they ran in

Check Point's blog advisory dates the exploitation activity from 30 October to 4 November 2026. The research write-up splits it: a first wave on 30 October against Israeli organisations, including destructive activity against some of them, and a broader second wave on 2 November across multiple countries and sectors with no destructive activity observed.

The hour chart is the part a small security team can act on. Requests cluster in a nine-hour window, with the two largest bars at 00:00 and 01:00 UTC, and the research links that window to working hours in one region. An internet-facing management portal that receives authenticated and unauthenticated traffic at 2 a.m. local time is worth a look in the web server log, whatever the vendor's attribution concludes.

The hotfix takes that carry the fix, and how to confirm it landed

The fix is inside the jumbo hotfix accumulators: R82.20 from Take 14, R82.10 from Take 52, R82 from Take 132, and R81.20 from Take 174. NVD lists the vulnerable side of those same branches as Take 10 or below, 50 or below, 130 or below and 173 or below.

Confirmation is mechanical, and this is where an operator earns the patch ticket. The advisory says the fixed build creates the socket as srw-rw---- root config, mode 0660. A build that still shows srwxrwxrwx is still in the affected world-writable state. The second check reads the daemon log: grep "Rejected connection from unauthorized uid" /var/log/dynamicCli.log returns entries such as uid 99 (pid 123456), and a burst of them correlates with authentication events on the portal.

Where a maintenance window is days away, Check Point offers a harder stop: disable the dynamic_server process and prevent it from restarting. The trade-off is stated in the advisory itself, because Dynamic CLI commands simply stop working, so the mitigation buys time at the cost of a documented capability.

What a root shell on an appliance reaches next

A firewall or a management server is the wrong place for a root shell to land. Both hold policy, both hold credentials for the estate they manage, and both sit on a network path that other systems trust. Root on a gateway means the attacker reads the rulebase, changes it, and uses the appliance's own trust relationships to reach hypervisors and management networks.

The remediation that follows from this incident has three parts. Patch the appliance branches in the estate, starting with anything internet-facing. Verify the socket mode and the log entries on each box, because a hotfix take number in a report is a claim and a 0660 socket is evidence. Then check what the appliance could reach from where it stood, including hypervisor service accounts, since that is the path this intrusion took. Fleet-level checks of that kind belong in infrastructure monitoring with plain-language alerts, where a changed socket mode or an unexpected log burst is visible without a nightly manual sweep.

Two numbers from this episode deserve to stay in view. A 9.2 unauthenticated portal flaw and a 7.8 local escalation were enough together to reach root on a security appliance, and the chart of when those requests arrived shows a nine-hour working day. The advisory is strong on product scope and appliance-level patch evidence; its count of a couple dozen unpatched systems covers the observed incidents in one region, leaving the wider installed-base exposure unmeasured.

Sources

• CVE-2026-123039, local privilege escalation to root in the DynamicCLI process, Check Point advisory sk1000362, created 8 November 2026, last modified 12 November 2026
• Security Advisory: Active Exploitation of PHP2Shell and Local Privilege Escalation, Check Point Blog, 12 November 2026
• PHP2Shell Exploitation on Check Point Gateway, Check Point Research, 12 November 2026
• CVE-2026-123039 detail, National Vulnerability Database
• CISA Adds Two Known Exploited Vulnerabilities to Catalog, 13 November 2026

Source: Check Point advisory sk1000362 (support.checkpoint.com, retrieved 13 November 2026), Check Point's blog advisory of 12 November 2026, Check Point Research's PHP2Shell write-up of 12 November 2026, the NVD record for CVE-2026-123039, and CISA's KEV alert of 13 November 2026. Those pages carry the socket permissions, the affected products, the jumbo hotfix takes, the CVSS scores, the exploitation dates and the scanning-hour chart values quoted above.