Check Point zero-day CVE-2026-123039: root on your firewall

Your firewall runs a root daemon that takes orders from any local user. That's the Check Point zero-day CVE-2026-123039, and attackers have used it since late October. Check Point shipped emergency fixes on Thursday. On Friday, CISA put the flaw in its Known Exploited Vulnerabilities catalog, the Canadian Centre for Cyber Security confirms.

What actually happened

The bug is a local privilege escalation in Gaia OS, scored 7.8. Check Point's advisory post lists Management, Multi-Domain, Log Servers and Security Gateway, versions R80.30 through R82.20.

• The root cause. The DynamicCLI daemon (dynamic_server) runs as root and listens on a world-writable socket, /tmp/dynamic_socket. It doesn't authenticate who connects. Any local user sends a command, and it runs as root, per the advisory text BleepingComputer quotes.
• The chain. "Local" sounds safe. It isn't. Check Point says attackers got in through the Mobile Access portal with the PHP2Shell bugs, then used this flaw for root. Next came webshells, a backdoor, a pivot to a VMware ESXi host and wiper malware.
• The scale. The advisory BleepingComputer quotes says "a couple of dozen customers." Check Point's community post says "a few cases." Either way, it's real.
• Not affected. Spark firewalls aren't hit by this CVE. They are still exposed to the PHP bugs, and Check Point tells Spark owners to install the latest GA version.

The same Jumbo Hotfix also fixes CVE-2026-107484 in the Gaia Portal (7.3) and updates PHP, Node.js and the Linux kernel.

Why it matters for your business

If a Check Point box sits at the edge of your network, your MSP probably runs it. Check Point warned of two other exploited zero-days in September, so this is a pattern. A firewall is a Linux server with a web portal. Treat it like one.

Do this now:

1. Install the Jumbo Hotfix. Start with gateways that expose Mobile Access to the internet. The steps are in sk1000362.
2. Can't patch today? Stop dynamic_server and keep it from restarting. Check Point says you lose Dynamic CLI functions. Take that trade.
3. Hunt, don't assume. The exploit ran for weeks before the fix. Check Point published indicators of compromise. Look for commands run as root that skip the default Clish wrapper.
4. Snapshot first. Admins in Check Point's own forum report gateways that stopped responding after the install. Take a snapshot and patch one cluster member at a time.

Sources: Check Point CheckMates advisory, BleepingComputer, Canadian Centre for Cyber Security.