Check Point warns of zero-day flaw exploited for root access

Check Point Software has issued emergency hotfixes to remediate a high-severity local privilege escalation vulnerability actively exploited by threat actors since late October. The zero-day flaw allowed attackers to secure root privileges and establish long-term persistence across compromised networking infrastructure. Details regarding the emergency patching effort and underlying exploitation activity were documented in BleepingComputer's report on the vendor advisory.

This report details the architectural root cause within the Gaia operating system daemon, the enterprise appliances vulnerable to attack, and the complete multi-stage intrusion sequence leading to VMware ESXi wiping incidents. It also provides immediate mitigation instructions, detection commands, and historical context for network administrators, security engineers, and enterprise incident response teams managing perimeter gateways.

01Unauthenticated DynamicCLI daemon local socket flaw

The vulnerability, tracked as CVE-2026-123039, resides within the DynamicCLI Inter-Process Communication interface used to transmit privileged command requests to the underlying Gaia OS daemon. This background daemon, known as dynamic_server, executes continuously with full root-level permissions. In standard operations, it handles administrative execution requests across network appliances running the proprietary operating system.

Flawed permission controls on the appliance filesystem exposed the interface to local exploitation. The vendor confirmed that the daemon listens on a world-writable local socket located at /tmp/dynamic_socket without enforcing process authentication. Any authenticated local user on the system can write directly to this socket, triggering commands that run under root privileges.

Check Point explained the core security breakdown in its Thursday advisory, stating that the daemon fails to verify connecting entities. The company noted that an authenticated local user can send an arbitrary command straight to the socket and have it executed as root. This architectural oversight permitted intruders with low-level access to seize unrestricted appliance control.

02Exposed gateway hardware and enterprise management servers

Exploitation of CVE-2026-123039 impacts multiple core enterprise product lines across Check Point's hardware and virtual portfolio. The confirmed vulnerable systems list includes the company's standalone Firewall appliances and the enterprise-grade Security Gateway systems deployed at corporate network perimeters. These platforms serve as vital security boundaries for distributed corporate networks worldwide.

Centralized administrative platforms are equally vulnerable to exploitation through the unauthenticated socket. Check Point confirmed that its Multi-Domain Security Management Server, standard Security Management Server, and high-throughput Scalable Platforms all contain the flawed daemon interface. Attackers targeting these management consoles can undermine administrative controls across entire segmented networks.

Real-world attacks against these appliances began weeks before the vendor released patched software. In a formal security advisory published on Thursday, Check Point disclosed that it observed active exploitation of this vulnerability against a couple of dozen enterprise customers. The targeting demonstrated that adversaries specifically identified and weaponized the flawed socket on perimeter appliances.

03Multi-stage intrusion chain and wiper deployment

Threat actors leveraged CVE-2026-123039 as an escalation bridge within a complex multi-stage attack campaign. According to Check Point's technical investigation, adversaries first obtained initial foothold access to the Mobile Access portal by exploiting known PHP2Shell vulnerabilities. Once inside the perimeter portal as unprivileged users, they deployed zero-day exploits targeting the DynamicCLI socket to gain root control.

Upon elevating privileges to root, the intruders deployed persistent secondary tooling across the compromised systems. They dropped web shells to maintain external access and installed the TSGA backdoor alongside TSProxy malware. Investigators previously documented both malicious payloads during forensic analysis of earlier intrusion campaigns targeting Ivanti enterprise appliances.

The threat actors did not restrict their operations to network gateways alone. After securing root dominance, they pivoted from the compromised Check Point security gateway directly into connected internal network segments. Adversaries breached an internal VMware ESXi host and deployed destructive wiper malware designed to sabotage enterprise virtualization infrastructure.

04Daemon shutdown procedures and detection indicators

Organizations unable to install the emergency hotfixes immediately must implement temporary mitigation procedures. Check Point instructed administrators to halt the dynamic_server process and reconfigure systems to prevent the daemon from restarting automatically. Halting the daemon disables the unauthenticated socket endpoint, blocking local privilege escalation attempts while teams prepare formal software updates.

Security operations teams can inspect appliance activity using specific indicators of compromise provided by the vendor. Check Point noted that defenders should monitor logs for commands commonly associated with exploitation attempts. Systems exhibiting repeated anomalies around command execution require immediate forensic isolation and credential rotation.

Forensic analysis should specifically focus on socket-level execution artifacts and atypical system calls. Check Point advised that the use of the system() sink remains uncommon or absent in legitimate gateway traffic. Furthermore, commands that bypass the default Clish wrapper indicate that an attacker executed commands directly as root through the local socket.

05Repeat exploitation patterns across enterprise infrastructure

The disclosure of CVE-2026-123039 follows recent critical vulnerabilities uncovered across Check Point's product ecosystem. In September, the vendor notified customers of active zero-day attacks exploiting two critical remote code execution flaws. Those vulnerabilities, tracked as CVE-2026-93616 in Security Management Server and CVE-2026-85102 in Security Gateway, required no prior authentication or privileges on targeted systems.

Federal regulatory records highlight persistent adversary focus on network appliance software. Over the last two years, the US Cybersecurity and Infrastructure Security Agency added five Check Point vulnerabilities to its Known Exploited Vulnerabilities catalog. Two of those cataloged flaws were subsequently weaponized by ransomware gangs during extensive corporate extortion operations.

The chaining of web portal flaws with local privilege escalation underscores ongoing threats to edge infrastructure. Network appliances remain prime targets for state-sponsored and financially motivated operators seeking unmonitored footholds inside corporate boundaries. Rapid patching and defensive verification of internal hosts remain necessary to stop lateral pivot activity.