Check Point ships hotfixes for root-escalation flaw exploited against about two dozen customers
Organisations running affected Check Point products should patch now or stop the dynamic_server process, since attackers have had root access on some devices since late October.
Check Point has shipped emergency hotfixes for a high-severity local privilege escalation flaw, CVE-2026-123039, which attackers have been abusing since late October to reach root and keep a foothold on affected devices. The bug sits in the DynamicCLI inter-process interface, where a root-level daemon accepts commands over a world-writable local socket without checking who is connecting, so any authenticated local user can run commands as root. The company confirmed active exploitation against roughly two dozen customers and named its Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway and Security Management Server products as affected. In a separate analysis, the company described a chain in which intruders entered through the Mobile Access portal via the PHP2Shell flaw, escalated with this zero-day, planted webshells and backdoors, and then moved to a VMware ESXi host to deploy wiper malware. Customers who cannot patch immediately are advised to stop the dynamic_server process and stop it from restarting, and to hunt for suspicious socket-driven commands that bypass the default Clish wrapper.
Why it matters
The flaw lets any local user on an affected device run commands as root, and attackers have combined it with an earlier web portal weakness to gain a foothold on Check Point gateways. For operators of these appliances, the risk is that a compromised perimeter device becomes the entry point to the rest of their network, which is why the vendor is urging immediate patching or the temporary mitigation of stopping the vulnerable daemon.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.