NEWS

Check Point Patches Gaia Zero-Day Exploited for Root Access Since Late October

CVE-2026-123039 lets local users reach root via an unauthenticated Gaia socket. Check Point saw exploitation at about two dozen customers; hotfixes are out.

Dylan H.

News Desk

November 13, 2026
2 min read
Check Point Patches Gaia Zero-Day Exploited for Root Access Since Late October

Overview

Check Point Software has released emergency hotfixes for CVE-2026-123039, a high-severity local privilege escalation flaw in Gaia OS that attackers have been exploiting since late October. Check Point says it observed exploitation against "a couple of dozen customers" before disclosing the flaw in an advisory (sk1000362).

The Flaw

The bug sits in the DynamicCLI IPC interface. Requests for privileged commands go to the dynamic_server daemon, which runs as root in Gaia OS. The daemon listens on a world-writable local socket, /tmp/dynamic_socket, and does not authenticate the processes that connect to it. Any authenticated local user can therefore send commands that execute as root.

Affected product lines named in the report:

  • Firewall
  • Multi-Domain Security Management Server
  • Scalable Platforms
  • Security Gateway
  • Security Management Server

The source report does not list affected version numbers or a CVSS score. Take those from Check Point's advisory.

Observed Attack Chain

Check Point's separate research describes a multi-stage intrusion:

  1. Attackers first exploited the PHP2Shell vulnerability to reach the Mobile Access portal.
  2. They escalated to root with CVE-2026-123039.
  3. They dropped webshells and installed the TSGA backdoor and TSProxy malware, both previously seen in attacks on Ivanti appliances.
  4. They pivoted from the gateway to a VMware ESXi host and deployed destructive wiper malware.

Recommended Actions

  • Install the hotfixes from advisory sk1000362 on all affected gateways and management servers.
  • If you cannot patch immediately, stop the dynamic_server process and prevent it from restarting. Check Point describes this only as a temporary measure.
  • Hunt for compromise: look for commands commonly tied to exploitation, use of the system() sink (uncommon in legitimate traffic), and commands that bypass the default Clish wrapper, which suggests root execution through the socket.
  • Review Mobile Access exposure and the PHP2Shell fix status, since it was the entry point in the reported chain.
  • Check ESXi hosts reachable from the gateway for signs of tampering.
  • Pull the published IOCs from Check Point's research page and search your logs.

Context

In September, Check Point disclosed two other zero-days: CVE-2026-93616 (Security Management Server) and CVE-2026-85102 (Security Gateway RCE). CISA has added five Check Point flaws to its KEV catalog over the past two years.

Source