TSProxy

Check Point Releases Emergency Hotfixes for Zero-Day CVE-2026-123039 Exploited for Root Access

Check Point has issued emergency hotfixes to address a high-severity local privilege escalation vulnerability tracked as CVE-2026-123039. The flaw resides in the DynamicCLI IPC interface of Gaia OS and has been actively exploited since late October to obtain root privileges and maintain persistence on affected devices. Attackers first compromised the Mobile Access portal via the PHP2Shell vulnerability before chaining it with CVE-2026-123039 to escalate privileges. They then deployed webshells, the TSGA backdoor, and TSProxy malware previously linked to Ivanti appliance attacks, pivoted to VMware ESXi hosts, and installed destructive wiper malware. Check Point observed the exploit targeting several dozen customers across its Firewall, Security Gateway, and Security Management Server products. Temporary mitigation involves stopping the dynamic_server process, while indicators of compromise include unusual system() sink usage and non-Clish commands. This marks the third zero-day campaign against Check Point products in recent months, following earlier exploitation of CVE-2026-93616 and CVE-2026-85102.