Check Point Software has released emergency hotfixes for CVE-2026-123039, a local privilege escalation vulnerability in the Gaia OS Dynamic CLI daemon. This vulnerability allows authenticated local users to execute arbitrary commands as root via a world-writable socket at /tmp/dynamic_socket.
Active exploitation of CVE-2026-123039 has been confirmed against several customers since late October. Attackers initially gained access through the PHP2Shell vulnerability.
The affected products include various Check Point firewalls and management servers. Check Point advises immediate deployment of the hotfix or temporary mitigation by disabling the dynamic_server process.
Indicators of compromise have been shared by Check Point to aid in detection and investigation efforts.