CISA Warns of Actively Exploited Check Point Zero-Day Vulnerability Allowing Attackers to Gain Root Access - GBHackers News
The Cybersecurity and Infrastructure Security Agency (CISA) has added a critical zero-day vulnerability in Check Point's Gaia OS to its Known Exploited Vulnerabilities catalog following active exploitation.
The vulnerability, identified as CVE-2026-123039, resides in the dynamic_server process that serves the Gaia OS DynamicCLI interface. This process accepts commands through a world-writable socket, allowing a locally executing attacker to submit commands that inherit root privileges.
This local privilege escalation breaks the security boundary between ordinary accounts and privileged services without requiring administrator credentials or additional victim interaction. Attackers have chained this flaw with the exploitation of CVE-2026-109618 and CVE-2026-109619 to gain initial access.
Once an attacker compromises a Mobile Access portal, they install PHP webshells and escalate privileges to gain control over the underlying security appliance. The TSGA backdoor then executes as /tmp/CPconfigdaemon and deploys a malicious library to intercept networking functions.
The attack chain illustrates how a service compromise can lead to persistent access and lateral movement. Investigators have observed attackers accessing VMware ESXi infrastructure through SSH and executing destructive tooling after gaining root access.
Affected Releases and Remediation
The flaw affects multiple branches of Check Point software, including R82.20, R82.10, R82, R81.20, and the end-of-support R81.10 and R81 releases. Impacted deployments span firewalls, management and log servers, Multi-Domain systems, and Maestro Orchestrator.
CISA has stated that Spark Firewalls and Smart-1 Cloud are unaffected. Available fixes include R82.20 Take 14, R82.10 Take 52, R82 Take 132, and R81.20 Take 174. Administrators should prioritize supported vendor updates rather than assume that restricting external management connectivity removes a locally reachable escalation path.
Organizations should follow vendor remediation guidance instead of treating manual socket permission changes as a complete security fix. Patched systems should expose /tmp/dynamic_socket with 0660 permissions and root:config ownership, reject unauthorized callers, and record their user identifiers.
Related
