[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fNck1cxARY-iIWGtbsBlVFvITfMRigecoGX1ePxOy_pM":3},{"article":4,"iocs":54,"watch_terms":71,"solutions":72,"lesson":166},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"43d8703c-3c28-48b1-9450-562cf32eb682","Check Point warns of zero-day flaw exploited for root access","check-point-warns-of-zero-day-flaw-exploited-for-root-access-02c1dc","Check Point Software has released emergency hotfixes to address a high-severity flaw that hackers have been exploiting to gain root privileges and establish persistence on vulnerable devices since late October. [...]","Check Point Software has released emergency hotfixes for a high-severity zero-day vulnerability (CVE-2026-123039) that allows attackers to gain root privileges and establish persistence on vulnerable devices. The flaw in the DynamicCLI IPC interface has been actively exploited since late October, with attackers chaining it with other vulnerabilities to deploy malware and wiper payloads. A temporary mitigation involves stopping the dynamic_server process.","Check Point warns of zero-day flaw exploited for root access.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fcheck-point-patches-zero-day-that-lets-hackers-get-root-access\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F09\u002F18\u002FCheck-Point-headpic.jpg","2026-11-13T10:44:22+00:00","2026-11-13T11:00:11.678664+00:00",9,[17,20,23,25,27,29],{"name":18,"type":19},"Check Point","vendor",{"name":21,"type":22},"Firewall","product",{"name":24,"type":22},"Multi-Domain Security Management Server",{"name":26,"type":22},"Scalable Platforms",{"name":28,"type":22},"Security Gateway",{"name":30,"type":22},"Security Management Server","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,44,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59,62,65,69],{"type":56,"value":57,"context":58},"cve","CVE-2026-123039","Zero-day flaw allowing root access",{"type":56,"value":60,"context":61},"CVE-2026-93616","Previously disclosed RCE vulnerability in Security Management Server",{"type":56,"value":63,"context":64},"CVE-2026-85102","Previously disclosed RCE vulnerability in Security Gateway",{"type":66,"value":67,"context":68},"malware","TSGA backdoor","Malware dropped by attackers",{"type":66,"value":70,"context":68},"TSProxy",[18,24,26],{"controls":73,"vendors":159},[74,102,130],{"slug":75,"name":76,"problem":77,"products":78},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[79,87,94],{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":75,"product_name":91,"url":92,"description":93},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"slug":103,"name":104,"problem":105,"products":106},"patch-management","Automated patch management","Known holes get closed in days, not months.",[107,114,122],{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":103,"product_name":111,"url":112,"description":113},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":131,"name":132,"problem":133,"products":134},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[135,143,151],{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":152,"vendor_name":153,"vendor_logo":154,"product_slug":155,"product_name":156,"url":157,"description":158},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",[160],{"slug":161,"name":18,"logo_path":162,"roles":163},"check-point","\u002Fvendor-logos\u002Fcheck-point.png",[164,165],"affected","reported_by",{"slug":167,"title":168,"body":169,"framework_refs":170,"framework_notes":176},"check-point-zero-day-exploited-for-root-access-via-ipc-interface-flaw","Check Point Zero-Day Exploited for Root Access via IPC Interface Flaw","A zero-day vulnerability in Check Point's DynamicCLI IPC interface (CVE-2026-123039) allowed attackers to gain root privileges and establish persistent footholds on affected devices before a patch was available. The flaw was actively exploited since late October, meaning organizations were exposed for weeks without a vendor-supplied fix. Attackers chained this vulnerability with others to deploy malware and wiper payloads, amplifying the damage significantly. This incident underscores the critical need for rapid response to emergency vendor advisories, interim mitigations, and robust monitoring of privileged processes on security appliances.",[171,172,173,174,175],"CIS Control 7: Continuous Vulnerability Management (v8)","CIS Control 2: Inventory and Control of Software Assets (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 RS.AN-03: Analysis of incidents","NIS2 Article 21(2)(e)",{"NIS2 Article 21(2)(e)":177,"NIST SP 800-53 SI-2: Flaw Remediation":178,"NIST CSF 2.0 RS.AN-03: Analysis of incidents":179,"CIS Control 7: Continuous Vulnerability Management (v8)":180,"CIS Control 2: Inventory and Control of Software Assets (v8)":181},"This point requires security in acquisition, development, and maintenance including vulnerability handling, meaning operators of Check Point devices must have processes to act rapidly on zero-day disclosures and apply mitigations without delay.","SI-2 requires organizations to identify, report, and correct information system flaws promptly, directly covering the obligation to apply the emergency hotfix or interim mitigation for this actively exploited vulnerability.","Because exploitation began weeks before public disclosure, effective incident analysis processes would have helped detect anomalous root-level behavior on Check Point devices earlier in the attack chain.","This control requires organizations to continuously assess and remediate vulnerabilities, including applying emergency patches for actively exploited zero-days like CVE-2026-123039 on perimeter devices.","Knowing exactly which versions of Check Point software are deployed is a prerequisite for rapidly identifying which devices are exposed to this zero-day and prioritizing remediation."]