Check Point Gaia DynamicCLI flaw gives local users root, exploited after PHP2Shell

CVE-2026-123039 is a local privilege escalation in the DynamicCLI service of Check Point Gaia OS. It lets any local user run commands as root ¹. Affected products are Security Gateways, Management and Log Servers, Multi-Domain Security Management, Multi-Domain Log Server and Maestro Orchestrator on R81 through R82.20 ¹. Fixes ship in Jumbo Hotfix takes for R82.20, R82.10, R82 and R81.20 ¹. R81.10 and R81 are end-of-support and have no fix listed ¹. Spark Firewalls and Smart-1 Cloud are not affected ¹.

Check Point says it saw active exploitation against "a couple of dozen customers" ¹. In the observed incidents, attackers first used PHP2Shell (CVE-2026-109618 / CVE-2026-109619), an unauthenticated RCE in the Mobile Access portal, against internet-facing gateways ². They then used this flaw to reach root, with activity running from 2026-10-30 to 2026-11-04 ². Check Point Research describes two waves ³: - 2026-10-30: Israeli organizations were targeted, with destructive activity at some. - 2026-11-02: a broader wave across several countries and sectors, with no destruction observed.

With root, the attackers did the following ³: - planted PHP webshells in the portal templates - installed the TSGA backdoor and the TSProxy library - ran the gogo scanner from the gateway In a limited number of cases they moved over SSH to VMware ESXi hosts and ran a wiper that leaves DREAM_ANNEXATION.txt notes ^2,3. Check Point Research says TSGA and TSProxy are modified variants of PhiliKit, a toolkit ESET linked to UNC5221. However, it declines to attribute this activity with high confidence ³. VulnDigest found no public proof-of-concept. The CVE is not in CISA KEV.

Gaia's dynamic (extended) CLI is served by dynamic_server, a daemon running as root that listens on the local IPC socket /tmp/dynamic_socket ¹. On affected builds the socket is created with mode 0777 ¹. The daemon does not authenticate the connecting process, and it executes any command string it receives as root ¹. The CNA record lists CWE-732 (incorrect permission assignment for a critical resource) and CWE-862 (missing authorization) ⁴.

Exploitation requires an existing local account or local code execution on the appliance, and any unprivileged user is enough ¹. That is why the CVSS vector is local with low privileges required ⁴. On its own the bug is not remotely reachable. In the observed attacks, PHP2Shell supplied code execution as the Mobile Access portal service account, and this flaw raised it to root ³.

The fix rejects unauthorized callers to the Dynamic CLI and logs them ¹. On a fixed system, /tmp/dynamic_socket has mode 0660 and is owned by root:config ¹.

1. 1

   Install the fixed Jumbo Hotfix on all Security Gateways and Management Servers ^1,2: - R82.20 Take 14 or later - R82.10 Take 52 or later - R82 Take 132 or later - R81.20 Take 174 or later Check Point asks customers to install the November Jumbo Hotfix as soon as operationally possible ².

2. 2

   Apply the PHP2Shell fixes (sk1000302), which have been available since 2026-10-23 ². The observed chain began with PHP2Shell, which gave the attackers local access. Upgrade internet-facing Mobile Access deployments first ².

3. 3

   If you cannot patch yet, stop dynamic_server and prevent it from restarting, using the dbset process commands in sk1000362 ¹. This disables the Dynamic CLI commands listed in sk144112 until the process is re-enabled ¹.

4. 4

   Move gateways on R81.10 or R81 to a supported, fixed release, because no fix is listed for them ¹. Until then, limit exposure of the Mobile Access portal to trusted networks where operations allow.

5. 5

   If the Mobile Access portal was internet-facing and unpatched between 2026-10-30 and 2026-11-04, treat the gateway as potentially compromised. Run the dynamicCli.log hunts and the IOC sweep on every gateway and cluster member ^1,3.

6. 6

   On suspected compromise, treat the appliance configuration as stolen. TSGA steals configuration and can persist through snapshots and backups ³. Rotate admin, VPN and other credentials and secrets stored on the gateway, and do not restore from snapshots taken after initial access.

7. 7

   Review SSH access from gateways to internal hosts, particularly VMware ESXi. Check those hosts for wiper activity and DREAM_ANNEXATION.txt notes ³.

• dynamic_server logs every command it receives to /var/log/dynamicCli.log ¹. Legitimate requests use a standard Clish wrapper that starts by sourcing CPprofile.sh. On each gateway or cluster member, review any Received = line that lacks this wrapper as possible root execution through the socket ¹.
• Search dynamicCli.log for two further patterns ¹: - lines showing the system() sink (Received = #return_value#), which is rare or absent in normal use - commands typical of exploitation, such as nc, curl, wget, base64, useradd, /etc/shadow or authorized_keys The exact grep commands are in sk1000362 ¹.
• On patched systems, look for Rejected connection from unauthorized uid in dynamicCli.log ¹. A non-zero or unexpected UID (for example 99/nobody) is a blocked escalation attempt. Correlate any bursts with Mobile Access portal, web and authentication logs ¹.
• Confirm the fix is in place: /tmp/dynamic_socket should show mode 0660 and owner root:config, not 0777 ¹.
• Look for traces of the PHP2Shell stage in the Mobile Access portal during the attack window ^2,3: - hundreds of Apache/PHP worker segfaults - PHP session files under /opt/CPcvpn-R81.20/tmp/, including ones containing upload_progress_pwn
• Check firewall traffic logs for unexplained gaps, especially after a crash of the logging daemon ². TSGA can tamper with binary firewall logs ³.
• Check the file locations in the IOC list for TSGA/TSProxy artifacts and zz*.tpl webshells in the portal templates directory ³. Check Point cautions that a clean IOC sweep does not rule out compromise ².

1. Oct 23, 2026

   Check Point releases PHP2Shell fixes for Gateways and Management; sources do not say whether this release fixes CVE-2026-123039. ²

2. Oct 30, 2026

   First exploitation wave: PHP2Shell plus CVE-2026-123039 against Israeli organizations, including destructive activity. ³

3. Nov 2, 2026

   Second, broader wave across multiple countries and sectors; no destructive activity seen. ³

4. Nov 4, 2026

   Last date Check Point cites for active exploitation of the chain. ²

5. Nov 8, 2026

   Check Point creates sk1000362. ¹

6. Nov 12, 2026

   Check Point publishes its advisory and the Check Point Research report; sk1000362 is updated. ²

1. 1
   sk1000362 - CVE-2026-123039 - Local privilege escalation to root in the DynamicCLI process via local world-writable control socket

   Check Point · Vendor · Nov 12, 2026
2. 2
   Security Advisory: Active Exploitation of PHP2Shell and Local Privilege Escalation

   Check Point · Vendor · Nov 12, 2026
3. 3
   PHP2Shell Exploitation on Check Point Gateway

   Check Point Research · Research · Nov 12, 2026
4. 4
   CVE Record: CVE-2026-123039

   CVE Program / Check Point CNA · Database · Nov 12, 2026