GoKawiilCheck Point issues hotfix for zero-day root-access flaw in Gaia OS
Check Point Software released emergency hotfixes for CVE-2026-123039, a local privilege escalation flaw in the DynamicCLI IPC interface of its Gaia OS, which the company says has been actively exploited since late October against roughly two dozen customers. Attackers reportedly first breached the Mobile Access portal via a PHP2Shell vulnerability, then used the new zero-day to gain root access, deploy webshells and backdoors, and ultimately move to attached VMware ESXi hosts to install wiper malware.
GoKawiil's interpretation of the reporting above, not reported fact.
The flaw affects a wide range of Check Point's core security products, including firewalls and management servers, meaning compromised devices could give attackers a foothold deep inside enterprise networks. The chained exploitation—from web portal to root access to backdoor to destructive wiper on virtualization infrastructure—suggests a sophisticated, multi-stage campaign rather than opportunistic attacks, according to Check Point's own reporting. Organizations unable to patch immediately are advised to disable the vulnerable process, underscoring the urgency security teams face in closing this exposure.
- CVE-2026-123039 allows local privilege escalation to root via an unauthenticated socket in Check Point's Gaia OS DynamicCLI daemon.
- Attackers chained a PHP2Shell exploit with this zero-day to deploy backdoors, webshells, and ultimately wiper malware on connected ESXi hosts.
- Check Point has released hotfixes and recommends stopping the dynamic_server process as a temporary mitigation for those who can't patch immediately.
Source: bleepingcomputer.com, 2026-11-13
Published there as: “Check Point warns of zero-day flaw exploited for root access”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.