VulnerabilitiesNov 13, 2026

Check Point warns of zero-day flaw exploited for root access

Check Point warns of zero-day flaw exploited for root access.

Check Point Software has released emergency hotfixes for a high-severity zero-day vulnerability (CVE-2026-123039) that allows attackers to gain root privileges and establish persistence on vulnerable devices. The flaw in the DynamicCLI IPC interface has been actively exploited since late October, with attackers chaining it with other vulnerabilities to deploy malware and wiper payloads. A temporary mitigation involves stopping the dynamic_server process.

AI summary of the linked source. Not reviewed by an editor. How this works

Read at source

Vendor Watch

Run Check Point?

Get an email when a new story names Check Point, usually within the hour.

Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch works Privacy

The lesson from this incident

Full lesson

A zero-day vulnerability in Check Point's DynamicCLI IPC interface (CVE-2026-123039) allowed attackers to gain root privileges and establish persistent footholds on affected devices before a patch was available. The flaw was actively exploited since late October, meaning organizations were exposed for weeks without a vendor-supplied fix. Attackers chained this vulnerability with others to deploy malware and wiper payloads, amplifying the damage significantly. This incident underscores the critical need for rapid response to emergency vendor advisories, interim mitigations, and robust monitoring of privileged processes on security appliances.

What helps against this

How we list vendors

Check Point research, affected

Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
For exampleBeyondTrust Password Safe ThreatLocker Privileged Access Management WALLIX PAM all options
Automated patch management
Known holes get closed in days, not months.
For exampleQualys Patch Management NinjaOne Patch Management Microsoft Intune all options
Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
For exampleHuntress Managed EDR CrowdStrike Falcon Insight XDR Bitdefender GravityZone all options

Indicators of Compromise

Extracted by AI from the linked source. Not reviewed by an editor. How this works

cve — CVE-2026-123039
cve — CVE-2026-93616
cve — CVE-2026-85102
malware — TSGA backdoor
malware — TSProxy

Entities

Check Point (vendor)Firewall (product)Multi-Domain Security Management Server (product)Scalable Platforms (product)Security Gateway (product)Security Management Server (product)