As reported by BleepingComputer, Check Point Software has shipped emergency hotfixes for CVE-2026-123039, a high-severity local privilege escalation (LPE) flaw in the Gaia OS DynamicCLI IPC interface that has been actively exploited against roughly two dozen customers since late October. What makes this advisory worth paying attention to is not the LPE itself — it is the full kill chain Check Point attributes to the same threat actor, which ends in a destructive wiper deployed against VMware ESXi after lateral movement through the gateway.

Security Impact: As reported by BleepingComputer, Check Point Software has shipped emergency hotfixes for CVE-2026-123039, a high-severity local privilege escalation (LPE) flaw in the Gaia OS DynamicCLI IPC interface that has been actively exploited against roughly two dozen customers since late October.

The vulnerability, in context

ItemDetail
CVECVE-2026-123039
SeverityHigh (per Check Point; NVD CVSS not yet published)
ClassLocal privilege escalation via unauthenticated world-writable Unix socket
Root causedynamic_server daemon runs as root, listens on /tmp/dynamic_socket with no caller authentication
Affected productsCheck Point Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway, Security Management Server
PatchVendor hotfix available — see Check Point advisory
WorkaroundStop and disable the dynamic_server process
In-the-wild exploitationYes — ~24 customers, since late October 2026

The mechanism is a textbook example of why IPC hygiene matters on hardened appliances. An authenticated, low-privilege local user can write to /tmp/dynamic_socket and have the root-level DynamicCLI daemon execute commands on their behalf. No authentication of the connecting process means any foothold on the box — including one obtained through a separate web-layer flaw — can be promoted to root. Check Point notes the attackers paired CVE-2026-123039 with a prior PHP2Shell exploit against the Mobile Access portal to achieve exactly that.

Why this chain is worse than the CVE alone

The reported attack path is notable for three reasons that defenders should internalize:
Why this chain is worse than the CVE alone
It mirrors the Ivanti playbook. Check Point explicitly links the dropped payloads — TSGA backdoor and TSProxy malware — to tooling previously observed in intrusions against Ivanti appliances. This suggests either a shared threat actor, a shared initial-access broker, or tool reuse across edge-appliance campaigns. Either way, perimeter appliance operators across vendors should treat the TSGA/TSProxy IOC set as cross-vendor relevant.
It ends in destruction. The actors pivoted from the gateway to a VMware ESXi host and deployed a wiper. That is not data-theft tradecraft — it is service-denial and potentially cover-for-exfiltration. Recovery from ESXi wiper events is routinely multi-day to multi-week, and the blast radius often exceeds what ransomware would produce because backups on the same cluster are frequently wiped alongside production VMs.
It is the third Check Point zero-day disclosure in two months. September brought CVE-2026-93616 (SMS RCE) and CVE-2026-85102 (Gateway RCE), both unauthenticated. Edge-appliance vendors are clearly under sustained, capable targeting — and defenders should assume the next advisory is a matter of when, not if.

Who is most exposed

Any organization exposing a Check Point Security Gateway, Multi-Domain Management Server, or Scalable Platform to the internet — particularly those with the Mobile Access portal enabled and reachable — should treat this as an incident-response priority, not a routine patching task. Internal-only deployments are materially less exposed to the initial PHP2Shell step, but the LPE still matters for any insider or post-compromise scenario.

Immediate Actions

  • Patch now. Apply the Check Point hotfix for CVE-2026-123039 to every affected appliance, including HA standby nodes and management servers.
  • If you cannot patch within hours, apply the workaround: stop the dynamic_server process and prevent restart. Validate that monitoring and management functionality you depend on still works without it.
  • Hunt for compromise before declaring clean. Check for commands executed outside the default Clish wrapper, use of the system() sink, unexpected files under web-accessible directories (PHP2Shell artifacts), and any process matching the TSGA/TSProxy indicators Check Point published. Review ESXi host logs for signs of lateral access from the gateway subnet.
  • Review ESXi posture. Confirm snapshots, vSAN backups, and immutable/off-host backups exist and are recoverable. Wiper actors routinely destroy in-cluster backups first.
  • Restrict management interfaces. Move SSH and web management off internet-reachable surfaces; gate them behind VPN or allowlisted jump hosts. Disable Mobile Access portal exposure for users who do not require it.

Shield53 Recommendations

Treat this not as a single-CVE patch event but as a campaign-driven hardening moment. Assume perimeter appliances are pre-compromise targets — enforce least-privilege on every management interface, segment the gateway-to-ESXi control path, and validate backup recoverability on a schedule that assumes a wiper, not just ransomware, is on the table.
  • Inventory all Check Point appliances and confirm the hotfix is applied across every node, including DR and passive HA peers.
  • Block lateral movement from the gateway to virtualization hosts at the network layer; ESXi management should not be reachable from the security segment without explicit policy.
  • Enable and centralize Gaia OS audit logging; ship to a SIEM that can alert on non-Clish root command execution.
  • Conduct a tabletop on edge-appliance-to-ESXi wiper recovery — this exact chain is now demonstrated in the wild against Check Point and is unlikely to remain vendor-specific.
  • Subscribe to Check Point and CISA KEV updates; the rate of edge-appliance zero-days makes manual tracking insufficient.