CVE-2026-123039: Check Point DynamicCLI Socket Escalation in KEV

CISA added CVE-2026-123039 to the Known Exploited Vulnerabilities catalog on November 13, 2026. Check Point sk1000362 describes a local privilege escalation: Gaia OS dynamic_server runs as root, listens on /tmp/dynamic_socket, and on affected builds the socket is 0777 world-writable with no authentication of the connecting process. Any local process that can write to the socket can have arbitrary commands executed as root (CISA and sk1000362 describe this as escalation after local code execution).

Check Point observed active exploitation against a couple of dozen customers, chained after PHP2Shell on internet-facing Mobile Access portals. Check Point's November 12, 2026 security blog ties the same CVE to that campaign. Install the November Jumbo Hotfix on Management Servers and Security Gateways, or disable dynamic_server until you can.

TL;DR

Mechanism: world-writable root IPC

Check Point sk1000362 states the Dynamic CLI is served by dynamic_server, a root process using a local IPC socket at /tmp/dynamic_socket. On vulnerable versions:

• The socket is created world-writable (0777).
• The daemon does not authenticate which local process connects.
• Whatever command string the client writes is executed as root.

That design fails the usual Unix trust model: a local UID with any foothold on the appliance (for example the portal web user after PHP2Shell) can bridge to full root without a kernel exploit.

After the fix

The article says a patched box should show:

ls -l /tmp/dynamic_socket

with srw-rw---- root config (0660), not srwxrwxrwx (0777). Blocked anonymous attempts log lines such as:

grep "Rejected connection from unauthorized uid" /var/log/dynamicCli.log

Example: [DynamicCLI]: Rejected connection from unauthorized uid 99 (pid 123456) — a non-zero unexpected UID means someone probed the socket after the fix is in place.

Observed attack chain (PHP2Shell plus DynamicCLI)

Check Point's blog advisory and Check Point Research's PHP2Shell write-up describe a multi-stage intrusion on internet-facing gateways:

1. Initial access — PHP2Shell (CVE-2026-109618 / CVE-2026-109619) on Mobile Access Portal web interfaces, unauthenticated remote code execution with CVSS 9.2 in the vendor table. A PHP hotfix was available October 23, 2026; many victims lagged into the November Jumbo Hotfix bundle.

2. Local foothold as portal service account — attacker-controlled PHP runs with limited but local privileges on Gaia.

3. Privilege escalation — CVE-2026-123039 — attacker writes crafted requests to /tmp/dynamic_socket; dynamic_server runs them as root.

4. Persistence and lateral movement — Research describes PHP webshells, the TSGA backdoor and TSProxy networking component, SSH pivot to VMware ESXi, and in some cases wiper tooling and politically themed notes. explainx.ai has the full news timeline for PHP2Shell.

5. Timeline — blog text places exploitation from October 30 through November 4, 2026, with Israeli organizations hit in an early wave and destructive activity in a subset of cases.

The DynamicCLI bug is not reachable from the internet by itself. It is the second stage that turns portal RCE into full appliance ownership, matching patterns in Barracuda's chained KEV flaws where low-trust entry meets high-trust execution.

For PHP2Shell mechanics on developer stacks (OOM and stale state), see the Beam explainer on how PHP2Shell works and the AI-assisted Fragnesia campaign for how quickly weaponization followed disclosure.

Who is affected

Per sk1000362 product tables:

The November 12 blog also lists related same-release fixes you should not ignore when planning change windows: CVE-2026-107484 (Gaia Portal backend), CVE-2026-120490 (management NAT rule boundary), and the PHP2Shell pair above, each with its own SK article.

Federal teams should map CISA KEV for CVE-2026-123039 to BOD 26-04 timelines. Private security teams should treat KEV plus vendor "couple of dozen customers" language as incident-response priority, not next-quarter hygiene.

Patch, mitigate, and hunt

Permanent fix — Jumbo Hotfix levels

From sk1000362:

• R82.20 — Jumbo Hotfix Accumulator from Take 14
• R82.10 — from Take 52
• R82 — from Take 132
• R81.20 — from Take 174

Check Point's blog recommends installing the November Jumbo Hotfix on all Management Servers and Security Gateways and prioritizing internet-facing Mobile Access deployments.

Mitigation if hotfix cannot land immediately

dbset process:dynamic_server off
dbset :save

Confirm the process is stopped (Expert mode):

ps auxw | grep -v grep | grep 'dynamic_server'

Re-enable after patching:

dbset process:dynamic_server t
dbset :save

Stopping dynamic_server breaks Dynamic CLI commands listed in sk144112 until you patch.

Indicators of compromise

Log hunting — /var/log/dynamicCli.log records every command. Legitimate traffic uses a Clish wrapper prefix like:

Received = #524288# . /opt/CPshared/5.0/tmp/.CPprofile.sh >> /dev/null; export SP_DISTRIBUTE=0; set -o noglob; 2>&1

Any command without that wrapper may mean root execution via the socket and needs investigation.

Blog and Research IOCs (November 2026 advisory) include:

• Recon sources 130.94.19[.]204, 130.94.19[.]168
• PHP session files containing upload_progress_pwn
• Processes or binaries masquerading as CPconfigdaemon
• Scanner or wiper tooling under /tmp or /temp
• Ransom-style notes referencing "Dream Annexation" without payment demand
• Gaps in firewall traffic logs after logging daemon crashes

Research notes TSGA / TSProxy lineage to PhiliKit, a framework seen in Ivanti-class intrusions, so do not assume PHP2Shell-only cleanup is enough if you see persistent proxy behavior.

What this means if you run AI coding agents

This CVE does not live inside Claude Code, Codex, or an MCP server package. It matters when the same people who run agents also operate perimeter gear or let agents touch deployment pipelines:

• Agents must not be the patch authority on firewalls. If your workflow uses Codex or Claude Code to SSH into Gaia, edit dbset output, or commit Terraform that exposes Mobile Access, require human approval on version pins and JHF take numbers. A mistaken dynamic_server re-enable in a scripted "fix" can reopen the socket path before the socket mode is 0660.

• PHP2Shell is the remote door. Developer machines running vulnerable PHP for side projects are a different surface, but the Check Point campaign shows edge PHP as the initial access that made local root worthwhile. Keep agent-suggested php.ini and container bases off known-bad PHP lines.

• Telemetry you trust may lie after root. Full appliance compromise can drop logging, similar to Research's traffic log gaps. Do not treat quiet dashboards as clean when IOCs match.

What Beam can and cannot do here

Beam is local-first observability for coding agents on your workstation: PreToolUse hooks, skill/MCP scanning, and on-device redaction. It does not install Check Point hotfixes or inspect Gaia sockets.

Where it still helps:

• If an agent reads CPR IOC blogs and tries curl | bash installers or writes webshell-like PHP into your repo, enforce-mode hooks can deny matched patterns on Claude Code and Codex (see how Beam watches risky actions for incident context).

• Heuristic skill scans catch obvious credential harvest patterns in new skills, but they do not replace firewall patching.

Beam cannot see /tmp/dynamic_socket on a remote gateway unless you deliberately route agent shell access there, which is a policy choice, not a product feature.

Related November 2026 Check Point fixes (same maintenance window)

The November 12 blog table groups five CVE families operators should not cherry-pick:

Patching only DynamicCLI on a host that still exposes vulnerable Mobile Access PHP leaves the remote front door open. Conversely, PHP2Shell remediation without CVE-2026-123039 leaves attackers one local write away from root after any future web bug.

Research also references HTTP2Shell / Node2Shell (CVE-2026-111497) as part of the broader November Jumbo theme—relevant if your agents maintain Node services adjacent to management networks. Beam covered Brotli CVE-2026-111497 exposure for developer-side dependency risk.

Step-by-step forensics on Gaia

Use this order so you do not destroy evidence while mitigating:

1. Export /var/log/dynamicCli.log and firewall traffic archives before disabling services if disk space allows.

2. Search for wrapper-less commands:

grep -v '/opt/CPshared/5.0/tmp/.CPprofile.sh' /var/log/dynamicCli.log

Treat non-empty output as high priority; correlate timestamps with Mobile Access and SSH auth logs.

3. Hunt PHP2Shell artifacts from the vendor list: session paths containing upload_progress_pwn, unexpected CPconfigdaemon processes, files under /tmp with scanner or wiper substrings.

4. Check socket permissions even on supposedly patched nodes—misconfigured upgrade paths sometimes leave 0777 until reboot:

ls -l /tmp/dynamic_socket

5. Apply JHF at the documented Take minimum, re-check socket mode 0660, and confirm grep "Rejected connection from unauthorized uid" appears when you deliberately probe with an unprivileged test (only in a lab).

6. Rotate management credentials and re-issue VPN profiles if root was obtained—attackers in the observed campaign pivoted toward ESXi and destructive tooling.

Canadian AV26-1154 mirrors Check Point's exploited-in-the-wild flag for CVE-2026-123039, useful when your executive sponsor wants a second government citation beyond CISA.

If your security operations center already tracks Unit 42 autonomous attack reporting, fold this incident into the same edge-first patch cadence: perimeter PHP surfaces and root-equivalent local IPC on appliances are exactly the targets scripted reconnaissance hits before it ever reaches a laptop running a coding agent.

Frequently asked questions

What is CVE-2026-123039?

A Gaia DynamicCLI design flaw: dynamic_server executes arbitrary strings from /tmp/dynamic_socket as root when the socket is world-writable and callers are unauthenticated.

Can attackers hit it from the internet directly?

No. They need local code execution first. Check Point's observed chain used PHP2Shell on Mobile Access Portal.

What is the fastest risk reduction?

November Jumbo Hotfix at the Take levels in sk1000362, or dbset process:dynamic_server off until maintenance.

How do I know the fix worked?

Socket 0660, Rejected connection from unauthorized uid log lines on probes, and absence of wrapper-less commands after patch.

Does Beam replace firewall patching?

No. Beam watches local agent actions; it does not manage Gaia lifecycle.

Related reading

• How PHP2Shell works: OOM, stale state, and mod_php risk
• PHP2Shell Fragnesia campaign and AI-assisted exploitation
• CVE volume 2026: triage KEV before raw count
• Barracuda ESG chained KEV flaws for comparison
• Recorded Future: AI incidents involving coding tools

Primary sources: sk1000362, Check Point security blog Nov 12, 2026, Check Point Research PHP2Shell exploitation, Canadian Centre AV26-1154, CISA KEV catalog.

Hotfix take numbers, IOCs, and KEV dates reflect Check Point and CISA publications as of November 13, 2026. Confirm take levels in sk1000362 before you schedule production failover.