The Socket Was Open. Root Was Free.
Check Point’s firewalls are supposed to be the thing standing between attackers and the network. This week the company admitted that, since late October, hackers have been using a flaw in its own products to gain root access on the devices themselves — and it has rushed out emergency hotfixes to stop them. The exploitation began in late October, which means the flaw had weeks of quiet use before the fix arrived.
The flaw is tracked as CVE-2026-123039, a local privilege-escalation vulnerability in the DynamicCLI interface — the inter-process communication channel Check Point’s Gaia operating system uses to send privileged command requests to its DynamicCLI daemon, known as dynamic_server. Check Point said it “observed an active exploit of this vulnerability against a couple of dozen customers.”
The root cause is blunt. The Gaia OS DynamicCLI daemon runs as root and listens on a local socket — /tmp/dynamic_socket — that is world-writable and does not authenticate the processes connecting to it. Any authenticated local user can send a command to that socket and have it executed as root. The socket was open. Root was free.
Part of a bigger break-in
The zero-day did not arrive alone. In a separate report, Check Point said the attackers first got into the Mobile Access portal by exploiting the PHP2Shell vulnerabilities — the flaws our earlier report covered — then used CVE-2026-123039 to escalate to root. From there they dropped webshells, installed the TSGA backdoor and TSProxy malware previously seen in attacks on Ivanti appliances, pivoted from the compromised gateway to a VMware ESXi host, and deployed destructive wiper malware.
The list of vulnerable products is wide: Check Point Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway, and Security Management Server. In other words, the flaw touches the core of a Check Point deployment, not a side component — and the devices it touches are the ones that guard everything behind them. A firewall that an attacker controls is worse than no firewall at all: it can be told to let traffic through, to hide its own compromise, and to serve as a launchpad into the network it was bought to protect.
What to do now
First, apply the emergency hotfixes. Check Point released them specifically for this flaw, and the exploitation is not theoretical — it has been active since late October against real customers. Check Point’s advisory lists the affected products and builds; match your fleet against it before you assume you are clear. If you run any of the affected products, treat this as a patch-now item, not a next-maintenance-window item.
Second, if you cannot deploy the hotfixes immediately, use the temporary mitigation Check Point published: stop the dynamic_server process and prevent it from restarting. That closes the socket the attackers are using. It is a stopgap — it disables the DynamicCLI service while it is down — but it is better than leaving a world-writable root socket listening.
Third, hunt for signs you were already hit. Check Point shared indicators of compromise and said customers can find evidence by looking for commands associated with exploitation attempts, use of the system() function — uncommon or absent in legitimate traffic — and commands that do not use the default Clish wrapper, which indicates they were executed as root through the socket. If you find any of those, assume the gateway is compromised and work the incident from there: the attackers in this campaign did not stop at root on the firewall. They pivoted to the virtualization host and wiped it.
Finally, put this in context. In September, Check Point warned that attackers were exploiting two other critical remote code execution flaws — one in its Security Management Server, one in its Security Gateway — in zero-day attacks that needed no privileges at all. Over the last two years, the U.S. Cybersecurity and Infrastructure Security Agency has added five Check Point flaws to its catalog of actively exploited vulnerabilities, two of which have also been abused by ransomware gangs. Security products are high-value targets precisely because they sit in the path of everything else — and as our report on the N-able zero-days showed, when a security platform falls, the blast radius is the whole customer base. Patch the gateway, check the socket, and check the hosts behind it.