CVE-2026-123039 in checkpoint quantum security gateway
Exploitation of this CVE does not show up in logs, so there is no detection rule for it.
What the vulnerability is
The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root.
Affected software: checkpoint quantum security gateway, checkpoint quantum security management
Scores
- CVSS: 7.8 (high)
- EPSS: 2.19% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2026-11-13
- Published: 2026-11-12
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Apply the Check Point Gaia hotfixes for DynamicCLI and Gaia Portal (sk1000362, sk1000291)
Patch or upgrade. Two Gaia OS flaws let an authenticated non-admin user run commands as root through the DynamicCLI socket or do admin-only actions in Gaia Portal. Check Point reports active exploitation of the DynamicCLI flaw (CVE-2026-123039) since late October, chained with PHP2Shell through the Mobile Access portal and followed by a wiper on VMware ESXi, so install the hotfixes now and stop dynamic_server until you can.
Applies to: Check Point Firewall, Security Gateway, Scalable Platforms, Security Management and Multi-Domain Management on Gaia versions listed as affected in sk1000362 and sk1000291
- Open sk1000362 and sk1000291 and note the emergency hotfix (Jumbo Hotfix Accumulator take) for your Gaia version.
- Check the installed Jumbo take on each Security Gateway, Scalable Platform and Management Server (cpinfo -y all or in Gaia Portal).
- If you cannot patch today, stop the dynamic_server process and prevent it from restarting, as Check Point advises in sk1000362, until the hotfix is installed.
- Install the listed hotfix via CPUSE in Gaia Portal or with the installer CLI and reboot when asked. Start with gateways that have an internet-facing Mobile Access portal.
- Limit Gaia shell and Gaia Portal accounts to administrators and remove unused local users.
- Restrict Gaia Portal and Mobile Access portal exposure; attackers reached the box through the Mobile Access portal (PHP2Shell) before escalating to root.
- Review expert-mode and shell history on the appliances for commands that did not run through the Clish wrapper, which Check Point names as a sign of exploitation.
- On gateways whose Mobile Access portal was exposed, hunt for the Check Point Research indicators: session files containing upload_progress_pwn under /opt/CPcvpn-*/tmp/, unexpected zz*.tpl or challenge_render.tpl templates, /tmp/.up.tpl, /tmp/CPconfigdaemon, slot_CPconfigdaemon, /lib/libcpfwcommon.so, /tmp/.p_sock and a listener on TCP 11072.
- Check vCenter and ESXi for SSH sessions from a gateway, especially as vpxuser, and for /tmp/des or DREAM_ANNEXATION.txt on ESXi hosts. If you find any, treat the gateway as compromised: rebuild it from clean media and rotate all credentials it held.
Sources:
- https://support.checkpoint.com/results/sk/sk1000362
- https://support.checkpoint.com/results/sk/sk1000291
- https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/
- https://www.bleepingcomputer.com/news/security/check-point-gateways-hacked-via-php2shell-to-deploy-vmware-esxi-wiper/
In the news
1 publication wrote about this CVE in the last 14 days, most recently on 2026-11-13.
- Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiper (BleepingComputer, 2026-11-13)
- Check Point warns of zero-day flaw exploited for root access (BleepingComputer, 2026-11-13)
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.