CISA lists exploited Check Point Gaia flaw that yields root
Original title: CISA Warns of Check Point 0-Day Vulnerability Exploited to Gain Root Access
Check Point says it saw exploitation at about two dozen customers; fixes start at named Jumbo Hotfix takes, with R81 and R81.10 unsupported.
CISA added CVE-2026-123039 to the Known Exploited Vulnerabilities catalog on November 13, 2026, after confirming real attacks. The CVSS 7.8 flaw is in Gaia OS DynamicCLI: a root process listens on a world-writable local socket and runs commands without authenticating the caller. A local user can become root, but remote code execution is not part of this bug. Check Point said it observed exploitation against a couple of dozen customers and shipped Jumbo Hotfix Accumulator fixes.
- Affected releases span R81, R81.10, R81.20, R82, R82.10, and R82.20.
- Fixes start at R82.20 Take 14, R82.10 Take 52, R82 Take 132, and R81.20 Take 174.
- R81 and R81.10 are end-of-support and have no listed fix.
- Spark Firewalls and Smart-1 Cloud are not affected.
- After patching, /tmp/dynamic_socket should be mode 0660, not 0777.
Impact: Local user runs arbitrary commands as root
| Product | Affected | Fixed in |
|---|---|---|
| Check Point Gaia OS DynamicCLI on Force Firewalls, management and log servers, Multi-Domain systems, and Maestro Orchestrator | R81, R81.10, R81.20, R82, R82.10, and R82.20 | R82.20 Take 14, R82.10 Take 52, R82 Take 132, R81.20 Take 174 |
- 1.Install the named Jumbo Hotfix Accumulator take for the running release.
- 2.If patching must wait, stop dynamic_server with dbset and save the change.
- 3.Inspect /var/log/dynamicCli.log for requests lacking the expected Clish wrapper.
- CVEs
- CVE-2026-123039
- Vendors
- Check Point
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-123039 | Local root command execution via Gaia OS DynamicCLI socket | 7.8 | 1% | KEV | KEV |
From the original article
2 min read at cybersecuritynews.com
CISA has warned that attackers are exploiting a Check Point security flaw that lets a local user gain root access on affected appliances. The agency added CVE-2026-123039 to its Known Exploited Vulnerabilities catalog on November 13, 2026, confirming that the vulnerability is being used in real attacks. Check Point said it observed exploitation against “a […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.