Check Point Software issued emergency hotfixes for a high-severity local privilege escalation vulnerability tracked as CVE-2026-123039. The flaw affects the DynamicCLI IPC interface in the Gaia OS, allowing authenticated local users to execute commands as root via a world-writable socket. Attackers have exploited this zero-day since late October to gain root access on dozens of customer systems. The attack chain involved initial access through PHP2Shell vulnerabilities, followed by privilege escalation and the deployment of backdoors and wiper malware. The list of Check Point products vulnerable to attacks includes the Firewall, Security Gateway, and Security Management Server.
Read the full story at bleepingcomputer.com.
Photo: wal_172619 / Pixabay
