Check Point rushes out patches for a reportedly exploited zero-day

The usual caveat first: for now, all of this rests on a single source, a Bleeping Computer article published on 13 November 2026, which relays a security advisory Check Point issued on Thursday and a separate report from the vendor. Every “reportedly” below is doing real work.

What happened

Check Point has reportedly released emergency fixes for CVE-2026-123039, a high-severity local privilege escalation flaw. According to the advisory quoted by Bleeping Computer, it has been exploited since late October to gain root and settle in for the long haul on vulnerable appliances. The vendor says it has observed active exploitation at a few dozen customers.

The bug is said to live in DynamicCLI, the inter-process communication interface of Gaia OS. The dynamic_server daemon reportedly runs as root and listens on a world-writable local socket, /tmp/dynamic_socket, without authenticating the processes that connect to it. An authenticated local user could therefore send it a command and have it executed as root. A root daemon that takes orders from whoever knocks: on a security appliance, that is quite the open-door policy.

Who is affected

The list of vulnerable products reported by Bleeping Computer covers Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway and Security Management Server.

The flaw can’t be exploited on its own from the outside: it needs local access first. According to Check Point’s report, the attackers got theirs by first exploiting the PHP2Shell vulnerabilities in the Mobile Access portal, then used CVE-2026-123039 to climb to root.

From the gateway to the ESXi host

Still according to that report, the attackers then dropped webshells before installing the TSGA backdoor and the TSProxy malware, both already spotted in investigations into attacks on Ivanti devices. Finally, they reportedly pivoted from the compromised gateway to a VMware ESXi host to deploy destructive wiper malware.

So the stakes go well beyond the appliance itself: a compromised security gateway would hand over the virtualisation infrastructure sitting behind it, with data destruction as the parting gift.

What to do

Three measures stand out from Check Point’s recommendations as reported by Bleeping Computer:

• Apply the emergency fixes released for CVE-2026-123039.
• If you can’t patch right away, stop the dynamic_server process and prevent it from restarting, as a temporary measure.
• Hunt for signs of compromise using the indicators shared by the vendor.

On that last point, Check Point reportedly lists three signals to check: the presence of commands commonly associated with exploitation attempts, use of the system() function, which is rare or absent in legitimate traffic, and commands that don’t go through the default Clish wrapper. That last case would point to root execution via the socket and call for a deeper investigation.

With exploitation going back to late October, you need to go looking for traces even once the patch is in.

A recent precedent

Bleeping Computer notes that back in September, Check Point had already warned about the exploitation of two other critical remote code execution flaws, CVE-2026-93616 in Security Management Server and CVE-2026-85102 in Security Gateway, in attacks that required no privileges on the targeted systems. The outlet adds that over two years, the US agency CISA has added five Check Point flaws to its catalogue of actively exploited vulnerabilities, two of which were also used by ransomware groups.

Patching changes the locks; it doesn’t tell you who is already sitting on the sofa. On a box that has been exposed since late October, your logs deserve as much attention as the patch.