Check Point hotfixes CVE-2026-123039 root flaw exploited on gateways

Check Point released emergency hotfixes for CVE-2026-123039, a local privilege-escalation flaw in the Gaia OS DynamicCLI process that attackers are using to escalate to root on compromised security gateways. Check Point says it observed active exploitation against a couple of dozen customers, starting in late October. The flaw is the second-stage half of the ongoing PHP2Shell gateway campaign: initial access comes from the already-patched PHP2Shell bugs, then CVE-2026-123039 turns a web shell into full root. If you run Check Point gateways and haven't applied the PHP2Shell patches or this hotfix, treat your appliance as potentially compromised.

What the bug is

Per Check Point's research writeup and support advisory sk1000362, the DynamicCLI daemon runs as root and exposes a local socket that an already-present low-privilege foothold can abuse to run commands as root. There is no CVSS score published yet; Check Point rates it high-severity. See the NVD entry for CVE-2026-123039.

Affected products, per Check Point: Security Gateway, Firewall, Scalable Platforms, Security Management Server, and Multi-Domain Security Management Server.

How it's chained

Initial access is PHP2Shell — CVE-2026-109618 and CVE-2026-109619, patched October 21. We covered the PHP2Shell exploitation when it first surfaced (PHP2Shell flaws exploited days before the patch and the Unit 42 / Lazarus overlap). CVE-2026-123039 is the escalation step that campaign was missing in the public record.

After getting root, the operators deployed the TSGA backdoor and TSProxy, which Check Point describes as variants of a framework it calls PhiliKit. Check Point links PhiliKit to the China-nexus cluster UNC5221 known for Ivanti exploitation — treat that as the vendor's assessment, not a settled fact. In at least one case the operators moved laterally to a VMware ESXi host and executed a wiper, making this a destructive intrusion, not just espionage.

Exploitation status

• Check Point: active exploitation against about two dozen customers, beginning late October.
• First wave hit Israeli organizations from around October 30; a second wave from November 2 spread across multiple countries, with no clear sector preference, per Check Point.
• Reporting at BleepingComputer and SecurityWeek matches Check Point's account.

Action checklist

1. Apply the hotfix for CVE-2026-123039 referenced in sk1000362, and confirm PHP2Shell (CVE-2026-109618 / -109619) is already patched. The escalation is only useful after the web-shell foothold.
2. If you can't patch immediately, Check Point's interim mitigation is to stop the dynamic_server process and prevent it from restarting.
3. Hunt for compromise. Check Point's guidance points at anomalous command execution on the gateway — commands run outside the default Clish wrapper and use of the shell system() sink. Pull the IOCs from Check Point's research post; do not rely on paraphrased indicators.
4. Check your ESXi estate for the lateral-movement and wiper activity if any gateway shows signs of the PHP2Shell foothold. Snapshots and immutable backups matter here — the end goal was destruction.

Context

This is the third Check Point gateway story on our radar this cycle, after the PHP2Shell web-shell flaws and the earlier IKEv1 VPN bypass CVE-2026-50751. Edge security appliances remain the highest-value target class: they terminate trust, sit at the perimeter, and — as the ESXi wiper here shows — give an attacker a launch point into the virtualization layer behind them. A patched PHP2Shell bug without this escalation fix still leaves the dangerous half of the chain open.