# Check Point Gaia CVE-2026-123039: DynamicCLI local root escalation, chained with PHP2Shell (threat hunt pack 1.0.0)

CybaVerse threat hunt pack, built 12 Nov 2026. All times GMT. Check Point is the vendor; its support article sk1000362
and its research team's post are the primary sources here, alongside cve.org, NVD and the CISA KEV catalogue.

## Vendor facts (all times GMT, 12 Nov 2026 unless stated)

| Item | Fact | Source (read at) |
|---|---|---|
| Advisory | sk1000362 "CVE-2026-123039 - Local privilege escalation to root in the DynamicCLI process via local world-writable control socket". Category Alert, created 2026-11-08, last modified 2026-11-12 | sk1000362 (17:08; the page renders its article data in the page source) |
| What it is | "Gaia OS dynamic/extended CLI is served by a root process dynamic_server, which listens on a local Inter-Process Communication (IPC) socket /tmp/dynamic_socket. On affected products, the socket is created world-writable (0777) with no authentication of the connecting process, and the dynamic_server process executes whatever command string it receives as root. As a result, any authenticated local user can run arbitrary commands as root by writing a single request to the socket." | sk1000362 |
| Pre-condition | "The issue is a local privilege escalation and requires the attacker to already have local code execution on the appliance." | sk1000362 |
| CVE record wording | "The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root." | cve.org (17:08) |
| Exploitation | "Check Point observed an active exploit of this vulnerability against a couple of dozen customers." | sk1000362 |
| Score | CVSS 3.1 7.8 HIGH, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Check Point as CNA). sk1000362: "a CVSS score of 7.8", severity HIGH. "Critical by impact (our framing)" is our wording only, because it is used after an internet-facing remote code execution | CVE record; sk1000362 |
| CWE | CWE-862 Missing Authorization and CWE-732 Incorrect Permission Assignment for Critical Resource | CVE record (CNA); NVD lists both as Secondary |
| CVE dates | Reserved 5 Nov 2026 07:30; published 12 Nov 2026 14:02 (CNA checkpoint) | cve.org |
| NVD | Published 14:17, status Received, CNA score 7.8 shown as Secondary; no NVD score of its own | NVD (17:08) |
| CISA KEV | Not in catalogue 2026.11.10 (released 10 Nov 2026 19:03), the latest at 17:08. That catalogue predates the CVE | KEV JSON (17:08) |

### Affected products and versions: the two lists differ, shown as published

**sk1000362:** Affected Products: Check Point Force Firewalls; Check Point Management and Log Servers; Multi-Domain
Security Management and Multi-Domain Log Server; Maestro Orchestrator. Non-affected Products: Check Point Spark
Firewalls, Smart-1 Cloud. Affected Versions: R82.20, R82.10, R82, R81.20, R81.10, R81 (its version field marks R81.10
and R81 as EOS).

**CVE record (cve.org, mirrored by NVD):** two products only, Quantum Security Gateway and Quantum Security Management,
each with "R82.10 with Jumbo Hotfix Take 50 or below", "R82.20 with Jumbo Hotfix Take 10 or below", "R82 with Jumbo
Hotfix Take 130 or below", "R81.20 with Jumbo Hotfix Take 173 or below". It does not list R81.10, R81, Log Servers,
Multi-Domain or Maestro Orchestrator.

We do not reconcile them. Our checker follows sk1000362, the vendor's own article: a Take below the sk's first fixed
Take is VULNERABLE even where the CVE record's ceiling is lower (R82.20 Takes 11 to 13, R82.10 Take 51, R82 Take 131).

### Fixes (sk1000362 "Solution")

| Version | First fixed Jumbo Hotfix Accumulator Take | Public resolved issues page (sc1.checkpoint.com) |
|---|---|---|
| R82.20 | Take 14 | Take 14 "Released on 12 November 2026", lists "Resolved CVE-2026-123039" (17:08) |
| R82.10 | Take 52 | Take 52 "Released on 12 November 2026", lists it (17:09) |
| R82 | Take 132 | Take 132 "Released on 12 November 2026", lists it (17:08) |
| R81.20 | Take 174 | NOT on the page at 17:09; the latest Take listed is 173 (12 Oct 2026). We give no date for Take 174 |
| R81.10, R81 | none | sk1000362 names no fix |

sk1000362 says the fix "blocks and logs unauthenticated calls" (log line "Rejected connection from unauthorized uid")
and: "Confirm the box is actually fixed. The output of the ls -l /tmp/dynamic_socket command should show srw-rw---- root
config (0660), not srwxrwxrwx (0777)." The 0660 state is therefore Check Point's statement, not ours.

### Campaign (Check Point Research post "PHP2Shell Exploitation on Check Point Gateway", 12 Nov 2026, read 17:08)

* "Beginning on 30 October 2026, an attacker executed scanning and exploitation activity against organizations with
  unpatched Check Point Security Gateways, using Mobile Access portals with PHP2Shell as initial access followed by
  CVE-2026-123039."
* Wave 1: "The first wave, on October 30, targeted Israeli organizations and included destructive activity against some
  of them." Wave 2: "A broader second wave on November 2 targeted organizations across multiple countries and sectors,
  with no evidence of destructive activity".
* Chain as described: PHP2Shell on the Mobile Access portal, then root through DynamicCLI, PHP webshells in the portal's
  login template directory (zz*.tpl, later challenge_render.tpl; uploads saved to /tmp/.up.tpl), the TSGA backdoor run
  as /tmp/CPconfigdaemon with output to /tmp/.bd.log, relaunched as slot_CPconfigdaemon in "the boot persistence
  directory", the embedded TSProxy library written to /lib/libcpfwcommon.so, a scanner on the gateway, SSH to a VMware
  ESXi host as vpxuser, the destroy_v6 wiper staged to /tmp/des, and DREAM_ANNEXATION.txt notes.
* The post does not attribute the activity with high confidence. We name no actor.

### PHP2Shell cross reference (initial access)

* CVE-2026-109618 and CVE-2026-109619 are in CISA KEV with dateAdded 26 Oct 2026 (vendor PHP Group), checked in
  catalogue 2026.11.10.
* Check Point's PHP2Shell article sk1000302: Check Point gives CVSS 9.2 for each; affected are Force Firewalls, Spark
  Firewalls and Cloud Firewalls using Mobile Access Portal, SSL Network Extender, SAML Remote Access, Identity Awareness
  Captive Portal, UserCheck Portal or Zero Phishing; Management and Log Servers are "not impacted". A hotfix was
  provided on "October, 23, 2026 at 18:30 GMT". Its Jumbo thresholds are the same Takes as sk1000362 (R82.20 Take 14,
  R82.10 Take 52, R82 Take 132, R81.20 Take 174), and the R82.20, R82.10 and R82 resolved issues pages list both CVEs
  in those Takes.
* Spark Firewalls are NOT affected by CVE-2026-123039 (sk1000362) but ARE affected by PHP2Shell (sk1000302).

## What to do

**Check Point's advice (sk1000362):**

1. Install the Jumbo Hotfix Accumulator Take that contains the fix (table above).
2. Mitigation: stop the dynamic_server process and prevent it from restarting: `dbset process:dynamic_server` then
   `dbset :save`. This makes the Dynamic CLI commands listed in sk144112 fail. To re-enable: `dbset
   process:dynamic_server t` then `dbset :save`. Check with `ps auxw | grep -v grep | grep 'dynamic_server'` in Expert mode.
3. Indication of compromise checks on each Force Firewall or cluster member: `grep "Received =" /var/log/dynamicCli.log`
   filtered for lines without the Clish wrapper, `grep -F "Received = #return_value#" /var/log/dynamicCli.log`, and a
   keyword grep for exploitation commands (id, whoami, /etc/shadow, ncat, nc, /dev/tcp, curl, wget, base64, useradd,
   authorized_keys), exactly as written in sk1000362.
4. After patching, confirm `ls -l /tmp/dynamic_socket` shows srw-rw---- root config (0660), and correlate bursts of
   "Rejected connection from unauthorized uid" with portal, web and authentication logs.

**OUR ADVICE (CybaVerse, not from Check Point):**

1. Inventory every Gaia gateway, cluster member, Management and Log Server, Multi-Domain server and Maestro
   Orchestrator, with version and Jumbo Take (`cpinfo -y all`, sk83860). Feed the output to the checker.
2. Patch now regardless of what the hunts find. For R81.20, until Take 174 is published, and for R81.10 and R81, which
   have no fix: apply the sk1000362 mitigation today, then upgrade to a fixed version.
3. Treat PHP2Shell as the way in. Any gateway that exposed Mobile Access or another affected portal before the
   sk1000302 fix should be handled as possibly compromised: Critical by impact (our framing), even though the CVE has a
   CVSS score of 7.8.
4. On those gateways run Check Point's dynamicCli.log checks, look for every file IOC below, check for a TCP 11072
   listener, and review the portal login templates for zz*.tpl and challenge_render.tpl.
5. If any IOC is found: isolate the gateway, preserve evidence before rebooting, open a case with Check Point, rotate
   every credential the gateway held or could reach (admin, VPN, LDAP and RADIUS bind accounts, certificates and keys),
   and check ESXi hosts reachable from the gateway for vpxuser SSH logins, /tmp/des and DREAM_ANNEXATION.txt. Rotate the
   vpxuser password through vCenter if SSH use is found. Restore from a backup taken before 30 Oct 2026, and remember
   that Check Point Research says TSGA has "backup and snapshot persistence".
6. Restrict SSH from gateways to hypervisors and management networks; disable SSH on ESXi hosts that do not need it.

## IOCs (defanged where they could be clicked)

| Type | Value | Source |
|---|---|---|
| IP | 130.94.19[.]204 (first wave origin) | Check Point Research |
| IP | 130.94.19[.]168 | Check Point Research |
| Path / name | zz*.tpl and challenge_render.tpl in the portal login template directory (directory not named) | Check Point Research |
| Path | /tmp/.up.tpl, /tmp/CPconfigdaemon, /tmp/.bd.log, /lib/libcpfwcommon.so, /tmp/.p_sock | Check Point Research |
| Name | slot_CPconfigdaemon (in "the boot persistence directory", path not given) | Check Point Research |
| Port | TCP 11072 listener on all IPv4 interfaces (TSGA) | Check Point Research |
| Session marker | upload_progress_pwn in PHP session files under /opt/CPcvpn-R81.20/tmp/ (the path seen in the post; other versions' paths are our assumption) | Check Point Research |
| Behaviour | hundreds of Apache/PHP worker segmentation faults during exploitation | Check Point Research |
| Log | /var/log/dynamicCli.log "Received =" lines without the standard Clish wrapper; "Received = #return_value#" | sk1000362 |
| Behaviour | SSH from the gateway to VMware ESXi as vpxuser | Check Point Research |
| ESXi | destroy_v6 wiper staged to /tmp/des; DREAM_ANNEXATION.txt notes | Check Point Research |

SHA-256, copied exactly from the Check Point Research IOC table (8 rows, names as the table writes them):

| SHA-256 | Name in the table |
|---|---|
| edb3e92eb7bda7413a09edcc4b1ba3cbed4bcdf42808a8abce63b6e4c3fda2b3 | tpl webshell |
| 4171b521fa6441382aa2fa014a08e18ff9a6e0ab6096c9144072bf46b37a2ec8 | slot_CPconfigdaemon |
| d7549671c7189979f0624ec52dad9ea6a707d23146e3585ab8f8c4720eca0c63 | CPconfigdaemon |
| 3b51080a909023f7d484e2443740b572307ce0054eb9e32d98f0a06bfcd2db90 | gogo |
| c7d9477309fac6c638a1128442056a242de086996add8cb49cd6496c36003237 | destory_v6 (spelling as in the table) |
| 0522937c0c0337be54fe25493539e5f5f8ceb9742c980aaff1cfc9515f3a96f7 | DREAM_ANNEXATION.txt |
| ee16e1695711b9d60c62925fcfb2fe1a29c18ae26565bc05410a14e16d2a39d7 | philistine |
| fb1a6235eb6bce8c9ec8cd8bb85f17c9c2bde8ecb45b7a243a30ceadf26654da | libdssafe.so |

The last two rows are samples of the earlier related framework the post compares TSGA and TSProxy with; the post does
not say they were found on the gateways in this intrusion.

## Caveats

* The KQL in this pack has NOT been run against a live tenant.
* KEV dates are for US federal agencies only (current KEV entries cite BOD 26-04). Not being in KEV is not a statement
  about exploitation; Check Point reports active exploitation in sk1000362.
* Patch now regardless of hunt results. A clean hunt is not proof the gateway was not accessed, and patching does not
  remove an implant.
* Gaia gateways do not run Defender for Endpoint. The Device* hunts cover other hosts only. Whether Gaia, dynamicCli.log
  or ESXi messages reach Sentinel, and in which columns, is [UNVERIFIED] for your connectors.
* The checkers never run anything on a gateway. Collect the inputs (cpinfo output, listings, log copies) with your own
  change process and feed them in offline.

## Unverified items

* Release date of R81.20 Jumbo Take 174 (named in sk1000362 and sk1000302; not on the public R81.20 resolved issues page
  at 17:09 GMT).
* Why the CVE record lists fewer products and versions and lower Take ceilings than sk1000362.
* The `cpinfo -y all` Jumbo line for current versions: sk83860 documents `HOTFIX_R77_30_JUMBO_HF Take: 135`; the
  `_MAIN` suffix the checker also accepts is [UNVERIFIED].
* The portal login template directory, the boot persistence directory, and the CPcvpn session path on versions other
  than R81.20 (not named in the sources).
* Syslog and ESXi log wording used by KQL V4, V5, V7, V8, O4 and the Sigma rules for checkpoint dynamiccli and esxi
  (logsource names are ours); the DeviceVendor value "Check Point" in KQL O1.
* The `ls`/`netstat` listing formats the checker parses for the socket and TCP 11072 lines.

## Contents

| Path | What it is |
|---|---|
| `kql/checkpoint-gaia-cve-2026-123039-hunting.kql` | 14 hunts. VENDOR IOC: V1 attacker IPs in firewall and Defender network logs; V1b attacker IPs in syslog; V2 SHA-256; V3 file paths and names on Defender Linux hosts; V4 file IOCs in gateway syslog; V5 sk1000362 dynamicCli.log checks; V6 TCP 11072; V7 ESXi SSH as vpxuser; V8 ESXi wiper artefacts. OUR PATTERN: O1 inventory of Check Point log sources; O2 SSH from gateways to ESXi; O3 internal scanning from a gateway; O4 segfault bursts; O5 new public sources to Mobile Access portals since 30 Oct 2026 |
| `sigma/*.yml` | 7 rules, all VENDOR IOC (listed below) |
| `sigma/converted/` | `sigma convert -t kusto` output for no pipeline and the four Microsoft pipelines, regenerated by `REGEN=1 tests/run_all.sh` |
| `scripts/check-checkpoint-gaia.sh` | read-only bash checker |
| `scripts/Check-CheckPointGaia.ps1` | PowerShell 7 twin with identical output and exit codes |
| `tests/` | cases, bash tests, Pester tests with parity, KQL parse check, run_all.sh gates, FIXTURE_ONLY fixtures |

### Sigma rules and conversion

| Rule | Logsource | Converts on |
|---|---|---|
| net_firewall_checkpoint_php2shell_attacker_ips | category firewall | no pipeline only |
| net_firewall_checkpoint_tsga_port_11072 | category firewall | no pipeline only |
| proc_creation_lnx_checkpoint_tsga_paths | linux process_creation | all five |
| file_event_lnx_checkpoint_campaign_files | linux file_event | all five |
| checkpoint_dynamiccli_unwrapped_command | product checkpoint, service dynamiccli (our names, UNVERIFIED) | no pipeline only |
| esxi_vpxuser_ssh_login | product esxi, service auth (our names, UNVERIFIED) | no pipeline only |
| esxi_destroy_v6_wiper_artefacts | product esxi, service shell (our names, UNVERIFIED) | no pipeline only |

The four Microsoft pipelines (microsoft_xdr, microsoft_365_defender, sentinel_asim, azure_monitor) have no table for
the firewall category or for the checkpoint and esxi products, so 5 of 7 rules do not convert there. Use KQL V1, V5, V6,
V7 and V8 instead.

## Checkers

```
check-checkpoint-gaia.sh --version R82.10 --take 50 [--product gateway] [--name NAME] [--review FILE ...]
check-checkpoint-gaia.sh --cpinfo saved-cpinfo-y-all.txt [--review FILE ...]
check-checkpoint-gaia.sh --inventory gaia.csv [--review FILE ...]      # header: name,product,version,take
check-checkpoint-gaia.sh --review dynamicCli.log --review listing.txt
Check-CheckPointGaia.ps1 -Version R82.10 -Take 50 -Review listing.txt  # same options, same output
```

Products: gateway (default; also security gateway, firewall, force firewall, cluster member), management, log server,
mds, mdls, maestro orchestrator, spark and smart-1 cloud. Anything else is UNKNOWN.

| Exit | Verdict | Meaning |
|---|---|---|
| 0 | PATCHED / NOT AFFECTED | Take at or above the sk1000362 fix, or Spark / Smart-1 Cloud |
| 1 | VULNERABLE | below the fixed Take, or a reviewed `ls -l` line shows /tmp/dynamic_socket as srwxrwxrwx |
| 2 | NO FIX | R81.10 or R81: mitigate now and upgrade |
| 3 | UNKNOWN | version, product or Take missing, malformed or not listed |
| 4 | usage or read error | |
| 5 | IOC REVIEW | a published IOC (or one of our two OUR PATTERN checks) matched in a --review file |

Order: 5 > 1 > 2 > 3 > 0. Review output prints only IOC labels, counts and line numbers, never the matched text.
No network, no writes, no secrets; the run_all gates enforce that and run both checkers in a network-less, read-only
sandbox.

## Testing

`tests/run_all.sh` (all must pass): ShellCheck, PSScriptAnalyzer, bash tests, Pester tests with byte-for-byte parity,
network and write guards, FIXTURE_ONLY and RFC 5737 checks on fixtures (the two vendor IOC IPs are the only other
addresses allowed), dash check, banned-name hashes, wording guards, KQL parse (Kusto.Language, offline), sandboxed runs
with sha256 before and after, `sigma check`, and conversions on all five targets.

## ATT&CK mapping (MITRE)

T1190 Exploit Public-Facing Application (PHP2Shell); T1068 Exploitation for Privilege Escalation (CVE-2026-123039);
T1505.003 Server Software Component: Web Shell; T1046 Network Service Discovery; T1021.004 Remote Services: SSH;
T1078 Valid Accounts (vpxuser); T1571 Non-Standard Port (TCP 11072); T1485 Data Destruction (destroy_v6).

## Sources

* Check Point sk1000362: https://support.checkpoint.com/results/sk/sk1000362
* Check Point Research, PHP2Shell Exploitation on Check Point Gateway: https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/
* Check Point sk1000302 (PHP2Shell): https://support.checkpoint.com/results/sk/sk1000302
* Check Point sk83860 (cpinfo -y): https://support.checkpoint.com/results/sk/sk83860
* Jumbo resolved issues: https://sc1.checkpoint.com/documents/Jumbo_HFA/R82.20/All_Resolved_Issues.html , https://sc1.checkpoint.com/documents/Jumbo_HFA/R82.10/All_Resolved_Issues.html , https://sc1.checkpoint.com/documents/Jumbo_HFA/R82/All_Resolved_Issues.html , https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/All_Resolved_Issues.html
* CVE record: https://www.cve.org/CVERecord?id=CVE-2026-123039
* NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-123039
* CISA KEV catalogue: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

## Changelog

* 1.0.0 (12 Nov 2026): first release.