ARTICLE ORIGINAL MAG212 CYBER

Check Point CVE-2026-123039: Root Through the Gateway, and How to Hunt dynamicCli.log

novembre 14, 2026 · El Mostafa Ouchen

Root through the gateway: Flow diagram of the Check Point attack: an internet request to a Mobile Access portal (reported), local code execution, a world-writable DynamicCLI socket giving root, then reported backdoors and an ESXi wiper, with patch an

From the MAG212 CYBER Weekly, 14 November 2026. Status labels: confirmed by vendor, reported by researchers, or unverified. Every command below is copied from official documentation and was not tested by MAG212; run it only on systems you are authorised to administer.

Status: Exploitation confirmed by vendor (sk1000362) and listed in CISA KEV (added 13 Nov, due 16 novembre) [1][3]. The initial-access chain (PHP2Shell through Mobile Access) and the post-exploitation tooling are reported by secondary sources citing Check Point Research. MAG212 could not reach Check Point Research to verify them [5][6][7].

Ce qui s'est passé

Check Point’s sk1000362, “Local privilege escalation to root in the DynamicCLI process via local world-writable control socket”, was created on 8 November and modified on 12 November. It states that Check Point “observed an active exploit of this vulnerability against a couple of dozen customers” [3]. Check Point, as CNA, published CVE-2026-123039 on 12 November with CVSS 3.1 7.8 (AV:L/AC:L/PR:L) [2]. CISA added it to KEV on 13 November [1]. A WindowsForum write-up and the “CTO at NCSC” weekly digest, both citing Check Point Research, say attackers chained PHP2Shell on Mobile Access portals with this escalation from 30 October. They then deployed webshells, the TSGA backdoor and TSProxy, and pivoted to ESXi to deploy a wiper [6][7]. There is no public attribution.

Qui est concerné ?

Per sk1000362 [3]:

  • Affected products: Force Firewalls (Quantum Security Gateways); Management and Log Servers; Multi-Domain Security Management and Multi-Domain Log Server; Maestro Orchestrator.
  • Non concerné : Spark Firewalls and Smart-1 Cloud.
  • Affected releases: R82.20, R82.10, R82, R81.20, R81.10 and R81. R81.10 and R81 are end of support, and no fix is listed for them.
LibérerFixed Jumbo Hotfix take (per sk1000362)
R82.20Take 14 and above
R82.10Take 52 and above
R82Take 132 and above
R81,20Take 174 and above
R81.10 / R81No fix listed (end of support). Upgrade.

Conflict to note in print. The CVE record lists vulnerable takes as “R82.20 Take 10 or below; R82.10 Take 50 or below; R82 Take 130 or below; R81.20 Take 173 or below” [2]. Takes in the gap (R82.20 T11–13, R82.10 T51, R82 T131) are ambiguous, so treat them as vulnerable until you reach the sk’s fixed take. Secondary coverage gives a wider “R80.30 to R82.20” scope [6]. If you still run R80.x, confirm with Check Point Support.

Why this matters

Firewalls and management servers sit above everything they protect. A root foothold there lets an attacker read traffic, steal VPN and integration secrets, and reach hypervisors, so a local-only CVSS 7.8 bug becomes an enterprise-wide incident once attackers already have code execution on the box. CISA's three-day KEV window shows how little time defenders get. (MAG212 analysis)

Flow diagram of the Check Point attack: an internet request to a Mobile Access portal (reported), local code execution, a world-writable DynamicCLI socket giving root, then reported backdoors and an ESXi wiper, with patch and log-hunting defences marked.
Diagram: MAG212 CYBER. Solid red = observed or vendor-confirmed; dashed amber = reported or unverified; green = recommended control.

Comment fonctionne l'attaque

  1. Initial access (reported, not verified by MAG212): PHP2Shell (CVE-2026-109618/-109619, unauthenticated PHP RCE, KEV since 26 Oct) against an internet-facing Mobile Access portal [6][57].
  2. Privilege escalation (confirmed): the root process dynamic_server listens on /tmp/dynamic_socket. The socket is world-writable and unauthenticated, so any local user who can already run code can send it commands that run as root [3].
  3. Post-exploitation (reported): webshells, TSGA backdoor, TSProxy [6][7].
  4. Impact (reported): pivot to ESXi and wiper deployment [6].
  5. Unknown: the actor, how targets were chosen, and dwell time.

Do not conflate this with Dream’s report of 24 compromised firewalls in a PHP2Shell campaign. The Record’s editor’s note identifies those devices as Palo Alto Networks, not Check Point [8].

Ce que les défenseurs doivent surveiller

All indicators below come from sk1000362 unless noted [3].

  • Log source: /var/log/dynamicCli.log, where the daemon records commands it receives.
  • Legitimate requests go through a Clish wrapper that begins CPprofile.sh >> /dev/null; export SP_DISTRIBUTE=0; set -o noglob;. Lines without that wrapper deserve review.
  • Received = #return_value# (the system() sink) is uncommon in legitimate traffic.
  • Keywords Check Point associates with exploitation: id, whoami, /etc/shadow, nc/ncat, /dev/tcp, curl, wget, base64, useradd, authorized_keys.
  • After patching: “Rejected connection from unauthorized uid” lines show blocked attempts. A non-zero UID such as 99 (nobody) indicates an attempted escalation.
  • Socket permissions: srw-rw---- root config (0660) is expected after the fix. srwxrwxrwx (0777) means the host is vulnerable.
  • False positives: administrators may legitimately run curl ou base64 during troubleshooting. Correlate any keyword hit with change tickets and the admin session record. A keyword hit alone is not proof of compromise.
  • Unverified leads from the earlier draft (single-sourced): these were not confirmed by any source MAG212 could reach. Treat them as hunting leads only, not as confirmed IOCs.
    • modified zz*.tpl portal templates
    • /tmp/CPconfigdaemon
    • /lib/libcpfwcommon.so
    • artifacts under /opt/CPcvpn-R81.20/tmp/
    • IP 130.94.19[.]204

How to investigate

Copie dynamicCli.log and the Mobile Access and web server logs off-box avant you patch or reboot. Run the hunting greps (CP-1 to CP-3) on every cluster member, management server and log server, not only the active gateway. The CVE needs a prior foothold, so every hit must be paired with a hunt for the initial-access vector, starting with the Mobile Access portal. If secondary reports of an ESXi pivot apply to you, review hypervisor management logins that originate from firewall or management IP addresses (MAG212 inference).

Contenir et remédier (dans l'ordre)

  1. Restrict internet exposure of Mobile Access and portal interfaces using an upstream control.
  2. Preserve logs (above).
  3. Install the fixed Jumbo Hotfix take for your release [3].
  4. If you cannot patch immediately, stop dynamic_server and prevent it from restarting using the dbset procedure in sk1000362. This breaks the Dynamic CLI commands listed in sk144112. To revert, set the value back to true and save [3]. MAG212 does not reproduce the dbset key. Copy it from the sk.
  5. If you find evidence of exploitation, treat the appliance as root-compromised: rebuild from trusted media with Check Point Support, and rotate administrator, VPN and integration secrets from a clean system.
  6. Upgrade R81.10 and R81 systems, which have no fix.

Vérifier la récupération

Confirm the installed take using cpinfo -y all (Expert mode) or show installer packages (Clish) [4] (CP-5). Confirm the socket is now 0660 (CP-4). After patching, “Rejected connection from unauthorized uid” entries show blocked attempts (CP-3b). Test VPN authentication and HA failover.

Prévention et sensibilisation

Keep management and Mobile Access interfaces off the open internet where the business allows. Ship appliance logs off-box. Retire end-of-support releases. Track PHP2Shell (fixed 21 Oct) in every appliance with a PHP-backed web UI [57].

Command reference: Check Point (source: sk1000362 [3]; sk98028 [4])

CP-1 – Find DynamicCLI commands that did not come through the legitimate wrapper

  • OS / shell / tool: Check Point Gaia, Expert mode (bash), grep
  • Privileges: Expert mode (administrator)
  • Purpose: list received commands that did not use the Clish wrapper
  • Read-only or change: Read-only
  • Command:
grep "Received =" /var/log/dynamicCli.log | grep -vF "CPprofile.sh >> /dev/null; export SP_DISTRIBUTE=0; set -o noglob;"
  • How to interpret: any output is a request that did not use the standard wrapper. Review each line against admin activity. No output means no such requests in the retained log, which depends on log retention.
  • Not tested by MAG212.

CP-2 – Find system()-sink requests and exploitation keywords

  • OS / shell / tool: Gaia Expert mode, grep
  • Privileges: Expert mode
  • Purpose: surface the uncommon #return_value# pattern and commands Check Point associates with exploitation
  • Read-only or change: Read-only
  • Commandes :
grep -F "Received = #return_value#" /var/log/dynamicCli.log
grep -EI "Received =.*( id;| whoami| /etc/shadow| ncat| nc -| /dev/tcp| curl | wget | base64| useradd| authorized_keys)" /var/log/dynamicCli.log
  • How to interpret: a hit is high-priority for triage. Correlate it with admin sessions before you declare compromise.
  • Not tested by MAG212.

CP-3b – See blocked attempts after the fix

  • OS / shell / tool: Gaia Expert mode, grep
  • Privileges: Expert mode
  • Purpose: confirm that the patched daemon is rejecting unauthorized local callers
  • Read-only or change: Read-only
  • Command:
grep "Rejected connection from unauthorized uid" /var/log/dynamicCli.log
  • How to interpret: entries mean something attempted to use the socket after the fix. A non-zero UID such as 99 (nobody) indicates an attempted escalation. Investigate which process ran as that UID.
  • Not tested by MAG212.

CP-4 – Check socket permissions and the daemon process

  • OS / shell / tool: Gaia Expert mode, ls, ps
  • Privileges: Expert mode
  • Purpose: confirm patched socket permissions and whether dynamic_server is running (relevant if you applied the interim mitigation)
  • Read-only or change: Read-only
  • Commandes :
ls -l /tmp/dynamic_socket
ps auxw | grep -v grep | grep 'dynamic_server'
  • How to interpret: expect srw-rw---- root config (0660). srwxrwxrwx (0777) means vulnerable. With the mitigation applied, dynamic_server should not appear in ps.
  • Not tested by MAG212.

CP-5 – Confirm the installed Jumbo Hotfix take

  • OS / shell / tool: Gaia Expert mode (cpinfo) or Gaia Clish
  • Privileges: Expert mode, or Clish administrator
  • Purpose: confirm the fixed take is installed on every member
  • Read-only or change: Read-only
  • Commandes :
    • (Expert mode, R81.x and higher), or from Gaia Clish:
cpinfo -y all
show installer packages
  • How to interpret: compare the reported JHF take with the fixed-take table above. sk98028 also lists GUI routes: Gaia Portal > Upgrades (CPUSE) > Status and Actions, and SmartConsole on R81.20 T38+ [4]. show version all est pas in sk98028, so MAG212 does not print it as verified.
  • Not tested by MAG212.

Sujets connexes sur MAG212 CYBER

Sources

  1. [1] CISA (GitHub mirror), “Known Exploited Vulnerabilities catalog JSON, catalogVersion 2026.11.13”, 13 Nov 2026, 20:24 UTC. link
  2. [2] CVE Program, “cvelistV5 CVE JSON 5 records (CVE-2026-123039, -124194, -125350, -123158, -6460 and others)”, Various, Nov 2026. link
  3. [3] Check Point, “sk1000362: Local privilege escalation to root in the DynamicCLI process via local world-writable control socket”, Created 8 Nov, modified 12 Nov 2026. link
  4. [4] Check Point, “sk98028: Jumbo Hotfix Accumulator FAQ”, Undated. link
  5. [5] Check Point Research, “PHP2Shell exploitation on Check Point gateway (unreachable)”, Not verified. link
  6. [6] WindowsForum, “CISA KEV alert: patch UnrealIRCd CVE-2026-114713 and Check Point CVE-2026-123039”, 13 Nov 2026. link
  7. [7] CTO at NCSC (Substack), “Summary, week ending November”, Nov 2026. link
  8. [8] The Record, “PHP2Shell: successful exploitation reports emerge”, 29 Oct 2026. link
  9. [57] Core Sentinel, “Cybersecurity news roundup, mid-November 2026 (Australia)”, 11 Nov 2026. link

Written and edited by El Mostafa Ouchen for MAG212 CYBER. Facts checked against the sources above as of 14 November 2026, 10:05 AM PST. Diagrams are original MAG212 CYBER illustrations.