Check Point Warns of Zero-Day Flaw Exploited for Root Access
Check Point said attackers used the flaw against about two dozen customers and then installed backdoors before moving to VMware ESXi hosts.
- On Thursday, Check Point Software released emergency hotfixes for CVE-2026-123039 after warning it observed active exploitation against a couple of dozen customers in a security advisory.
- Attackers initiated the breach by targeting the Mobile Access portal via the PHP2Shell vulnerability, then leveraged CVE-2026-123039 to execute commands through the Gaia OS DynamicCLI daemon as root.
- Once inside, threat actors dropped webshells and installed TSGA backdoor and TSProxy malware, then pivoted from the compromised Security Gateway to VMware ESXi hosts to deploy destructive wiper malware.
- Security teams unable to immediately deploy hotfixes should stop the dynamic_server process as a temporary mitigation, Check Point advised, while sharing indicators of compromise to identify exploitation attempts.
- CISA has added five Check Point flaws to its catalog of actively exploited vulnerabilities over the last two years, and this incident follows September alerts regarding two other zero-day remote code execution vulnerabilities.
11 Articles
11 Articles
CSO Online
Network WorldThe firewall becomes the foothold: Attackers turn Check Point gateways against customers
A firewall is intended to be a boundary attackers can’t cross. But firewalls face the web, making them just as vulnerable to attack as other systems, as evidenced by the emergency hotfixes released by Check Point Software for several of its products. The patches address a high-severity privilege escalation flaw, CVE-2026-123039, that gives attackers root privilege access and the ability to send commands to the Gaia OS Dynamic CLI daemon, a core …
Check Point warns of zero-day flaw exploited for root access
Check Point Software has released emergency hotfixes to address a high-severity flaw that hackers have been exploiting to gain root privileges and establish persistence on vulnerable devices since late October.
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #hacker - National Cyber Security Consulting
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Pierluigi Paganini November 14, 2026 U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Check Point and UnrealIRCd vulnerabilities to its Known Exploited Vulnerabilities (KEV) […] Thank y…
CISA Warns of Check Point 0-Day Vulnerability Exploited to Gain Root Access
CISA has warned that attackers are exploiting a Check Point security flaw that lets a local user gain root access on affected appliances. The agency added CVE-2026-123039 to its Known Exploited Vulnerabilities catalog on November 13, 2026, confirming that the vulnerability is being used in real attacks. Check Point said it observed exploitation against “a […]
Global Security Mag OnlineGlobal Security Mag OnlineMultiple vulnerabilities have been discovered in Check Point products, allowing an attacker to cause increased privileges and circumvention of security policy.
The CVE-2026-123039 vulnerability affects Check Point's Gaia OS and allows invaders to get root privileges. Explored along with PHP2Shell faults, the gap enables malware to be installed, maintain persistent access and hit ESXi VMware servers in destructive attacks. The manufacturer recommends applying emergency patches and investigating possible signs of impairment.
Coverage Details
Bias Distribution
- 100% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
