Exploited Check Point Gaia flaw CVE-2026-123039 lets local users run commands as root
Any user who can sign in to a Check Point gateway or management server can have commands run through an unauthenticated local socket. Check Point's response so far is the mitigation in sk1000362, and NVD's record is still undergoing analysis.
Affects
Check Point Gaia OS: Firewall
What to do
Apply the mitigation in Check Point sk1000362 to every Gaia appliance, then audit local accounts on each.
- KEV listed
- CVE
- CVE-2026-123039
- CVSS
- 7.8 (v3.1, Check Point, via NVD)
- Exploitation
- Exploited, in the CISA catalogue
- Affected
- Check Point Gaia OS: Firewall, Security Gateway, Security Management Server, Multi-Domain Security Management Server and Scalable Platforms
How the flaw works
The DynamicCLI daemon on Gaia OS runs as root and listens on a world-writable local socket without authenticating the processes that connect to it. An attacker needs an authenticated local login. A command sent to the socket then runs as root. Check Point describes it as local privilege escalation to root.
What to do now
Start with any appliance where people outside the firewall team hold a login, because the flaw turns each of those logins into root.
- Apply the mitigation in Check Point sk1000362 to every affected gateway and management server.
- List local accounts on each Gaia appliance and remove any the team cannot explain.
- Restrict SSH and web management to a named admin network or jump host.
- Rotate admin passwords and keys on any appliance that had untrusted local users.
- Preserve appliance logs before rebuilding anything, so an investigation has a record to work from.
Who is affected
Treat every Gaia gateway and management server as in scope until sk1000362 or NVD lists affected versions. NVD's record is still undergoing analysis. CISA gave US federal agencies until 16 November to apply mitigations.
Detection notes
CISA's required action pairs the vendor mitigation with its Forensics Triage Requirements, so treat an appliance with untrusted local users as a possible incident.
- Processes connecting to /tmp/dynamic_socket that the system did not start
- Root commands in audit logs that trace back to a non-admin session
- New local accounts, SSH keys or scheduled jobs on Gaia appliances
- Policy or configuration changes nobody on the firewall team made
Essential Eight mapping
Patch applications and patch operating systems: the Essential Eight Maturity Model sets 48 hours for internet-facing network devices where a working exploit exists, and this flaw is exploited. Restrict administrative privileges: fewer logins on each appliance leave fewer accounts the flaw can turn into root.
Sources
- PrimaryCISA, Known Exploited Vulnerabilities Catalog (release 2026.11.13)Retrieved 14 Nov 2026
- PrimaryCheck Point, sk1000362: CVE-2026-123039, local privilege escalation to root in the DynamicCLI processRetrieved 14 Nov 2026
- PrimaryNVD, CVE-2026-123039 (published 12 November 2026)Retrieved 14 Nov 2026
- PrimaryASD, Essential Eight Maturity ModelRetrieved 29 Oct 2026
