Check Point has shipped emergency hotfixes for CVE-2026-123039, a local privilege escalation in the Gaia OS DynamicCLI service. Attackers have exploited it as a zero-day since late October. Check Point says it saw the exploit used against “a couple of dozen” customers. This was not a standalone bug. Attackers chained it behind PHP2Shell (CVE-2026-109618 / CVE-2026-109619) on internet-facing Mobile Access portals to get root on the gateway. Then they installed a passive backdoor and, in some cases, moved to VMware ESXi hosts and ran a wiper. Check Point Research published the campaign on November 12, and reports say CISA added the CVE to the Known Exploited Vulnerabilities catalog on November 13 with a very short remediation deadline.

The exploit chain

Stage 1: PHP2Shell on Mobile Access. We covered PHP2Shell in October as a PHP engine memory-corruption pair that gives unauthenticated RCE through the request lifecycle. Check Point’s Mobile Access portal runs PHP on the gateway, so an exposed, unpatched portal gives the attacker code execution as the web-tier user.

Stage 2: CVE-2026-123039 (CVSS 7.8). On Gaia, a root-owned daemon (dynamic_server) serves DynamicCLI requests. Its job is to pass privileged configuration commands to the OS. The daemon listens on a world-writable UNIX socket, /tmp/dynamic_socket, and does not authenticate the connecting process. Any local user, including the compromised web process, can connect and send commands that run as root. Check Point classifies it as missing authorization.

Stage 3: Persistence. With root, the operators installed two components:

  • TSGA: a passive backdoor installed as slot_CPconfigdaemon that survives reboots. It can export the gateway configuration and tamper with firewall logs.
  • TSProxy: a shared library written to /lib/libcpfwcommon.so that hooks networking functions, which lets the operators hide inside legitimate gateway traffic.

Check Point assesses both as a modified variant of PhiliKit, a toolkit seen earlier in intrusions through Ivanti appliances.

Stage 4: Destruction. In some incidents the attackers went from the gateway to a VMware ESXi host over SSH, authenticating as the vpxuser service account (the account vCenter uses to manage hosts). They then ran a wiper, destroy_v6, which recursively deletes the target directory. They left a politically themed ransom-style note, DREAM_ANNEXATION.txt, that references Dream Security Ltd.

Timeline and targeting

  • Oct 30, 2026: First wave, aimed at Israeli organizations through vulnerable Mobile Access portals. Check Point Research ties it to infrastructure at 130.94.19[.]204.
  • Nov 2, 2026: A broader second wave hits organizations across multiple countries and sectors.
  • Nov 12, 2026: Hotfixes and the Check Point Research write-up are released.
  • Nov 13, 2026: CISA reportedly adds CVE-2026-123039 to the KEV catalog.

Attribution is open. Check Point says it cannot determine with confidence whether one actor ran the whole operation, sold access to another actor, or staged a false flag. The Israel-focused first wave and the political note fit Iran-nexus destructive operations seen before. That inference is not confirmed.

Affected and fixed versions

Affected Gaia releases are R81.20, R82, R82.10 and R82.20, on both Security Gateways and Management Servers. The fixed builds are:

ReleaseFixed in
R82.20Jumbo Hotfix Take 14
R82.10Jumbo Hotfix Take 52
R82Jumbo Hotfix Take 132
R81.20Jumbo Hotfix Take 174

Secondary reporting says R81.10 and R81 are also affected and get no hotfix. If you are still on those trains, upgrading is the fix.

What to do now

  1. Install the November Jumbo Hotfix on every gateway and management server. Do internet-facing gateways with Mobile Access or the SSL VPN portal enabled first. This hotfix fixes both PHP2Shell and the DynamicCLI escalation.
  2. If you cannot patch immediately, disable the Mobile Access blade on exposed gateways. Turn on Check Point’s PHP2Shell IPS protection and install policy. Reporting on the advisory also mentions stopping the dynamic_server process and keeping it from restarting as a stopgap. Test this first, because it affects CLI-driven configuration.
  3. Assume compromise on any gateway that was exposed and unpatched since Oct 30. Patching does not remove root-level persistence. Look for:
    • slot_CPconfigdaemon processes or boot entries
    • /lib/libcpfwcommon.so, which is not a stock Gaia file
    • unexpected connections to /tmp/dynamic_socket from web-tier processes
    • gaps or edits in firewall logs
    • traffic to 130.94.19[.]204
  4. Treat the gateway’s configuration as stolen. Rotate VPN pre-shared keys, certificates, LDAP/RADIUS bind credentials and admin passwords stored on or pushed through the box.
  5. Lock down ESXi. Check SSH logins as vpxuser that do not come from vCenter. Disable ESXi SSH where you don’t need it, and make sure management interfaces can’t be reached from firewall management or DMZ segments. Confirm you have offline, immutable backups of VM datastores.

Why it matters

The pattern is now familiar: a pre-auth web bug on a perimeter appliance, a local root escalation that the vendor never treated as internet-facing, and then destructive pivots into virtualization. A world-writable root socket with no peer authentication is a well-known anti-pattern. On a firewall, it turns any web-tier foothold into full device control. If your perimeter appliances can reach hypervisor management over SSH, this campaign shows how that path gets used.

References