CVE-2026-123039: Check Point Gateway Exploited Privilege Escalation Fixed in R82.20 Take 14

TL;DR

Check Point says attackers exploited CVE-2026-123039 against “a couple of dozen customers.” This Check Point Gateway vulnerability lets a local user run commands as root on Gaia OS. Attackers chained it with PHP2Shell flaws in the Mobile Access portal, starting on October 30, 2026.

CVE-2026-123039 (CVSS 7.8) is a root privilege escalation in the Gaia DynamicCLI service. Attackers used it after breaking in through PHP2Shell, then planted backdoors and, in some Israeli victims, ran a wiper. Jumbo Hotfix takes for R82.20, R82.10, R82 and R81.20 fix it.

Why It Matters

This is not a theoretical bug. The Check Point SK bulletin states: “Check Point observed an active exploit of this vulnerability against a couple of dozen customers.”

According to Check Point Research, the first wave hit Israeli organizations on October 30. It “included destructive activity against some of them.” A broader second wave followed on November 2 and reached multiple countries and sectors. Check Point found no destructive activity in that wave.

Timing also matters. The researchers say the attacks began “approximately one week after a security fix became available.” So unpatched gateways became targets quickly.

How the Attack Works

Step One: PHP2Shell

PHP2Shell covers two PHP flaws, CVE-2026-109618 and CVE-2026-109619. PHP patched them on October 21. CISA added both to its Known Exploited Vulnerabilities catalog on October 26. On the gateways, the attackers used them against Mobile Access portals to gain code execution as the portal service account.

Step Two: Root Through DynamicCLI

Next, they abused this Check Point Gateway vulnerability. Gaia runs a root process called dynamic_server, which listens on a local socket. On affected builds, that socket is world-writable and checks no identity.

The bulletin explains the result: “any authenticated local user can run arbitrary commands as root by writing a single request to the socket.” The flaw does require existing local code execution, which PHP2Shell supplied.

Step Three: Persistence and Wiper

With root access, the attackers placed PHP webshells in the portal’s login templates. They then launched a backdoor that Check Point calls TSGA, with an embedded proxy component, TSProxy. TSGA can steal configurations and tamper with firewall logs.

In the destructive cases, the attackers moved over SSH to a VMware ESXi host. There they ran the destroy_v6 wiper and left notes named DREAM_ANNEXATION.txt.

Who Is Behind It

TSGA and TSProxy are variants of PhiliKit, a toolset previously linked to China-nexus group UNC5221. However, Check Point stops short of attribution. The researchers write that “the evidence does not allow us to assess with high confidence the true nature of this operation.” They list a false flag and an access broker as plausible scenarios.

Affected Versions

The flaw affects Gaia R82.20, R82.10, R82, R81.20, R81.10 and R81 on these products:

• Check Point Force Firewalls
• Management and Log Servers
• Multi-Domain Security Management and Multi-Domain Log Server
• Maestro Orchestrator

Spark Firewalls and Smart-1 Cloud are not affected.

Patch and Mitigation

Fixed Jumbo Hotfix Takes

• R82.20 Take 14 and later
• R82.10 Take 52 and later
• R82 Take 132 and later
• R81.20 Take 174 and later

The bulletin lists no fixed take for R81.10 or R81. Admins on those releases should use the mitigation and plan an upgrade.

Temporary Mitigation

Check Point advises stopping the dynamic_server process and preventing its restart. Note that this breaks the Dynamic CLI commands listed in sk144112.

Hunt for Compromise

The daemon logs every command to /var/log/dynamicCli.log. Legitimate requests use a fixed Clish wrapper, so “any command that does not use this wrapper” needs investigation. After patching, the socket should show 0660 permissions, not 0777. Check Point also links the first wave to activity from 130.94.19[.]204.

Finally, patch PHP2Shell on the Mobile Access portal as well. Closing only one link in this Check Point Gateway vulnerability chain leaves the other open.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of Daily CyberSecurity. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.