CISA adds exploited Check Point Gaia root flaw to KEV catalog
Original title: CISA Warns of Actively Exploited Check Point Zero-Day Vulnerability Allowing Attackers to Gain Root Access
CVE-2026-123039 escalates a local Gaia user to root through an unauthenticated DynamicCLI socket; the KEV deadline is November 16.
CISA added CVE-2026-123039 to its Known Exploited Vulnerabilities catalog on November 13, 2026, with remediation due November 16. The flaw is in root-owned dynamic_server, which accepts unauthenticated commands over world-writable /tmp/dynamic_socket. Attackers chained Mobile Access portal bugs CVE-2026-109618 and CVE-2026-109619, installed PHP webshells and the TSGA backdoor, and moved laterally, including over SSH to VMware ESXi. Spark Firewalls and Smart-1 Cloud are unaffected.
Unconfirmed: The report says CISA reportedly added the entry; it does not detail a separate Linux kernel issue.
- Affected branches are R82.20, R82.10, R82, R81.20, R81.10, and R81.
- Fixes are R82.20 Take 14, R82.10 Take 52, R82 Take 132, and R81.20 Take 174.
- Patched sockets should be mode 0660 and owned by root:config.
- TSGA ran as /tmp/CPconfigdaemon, then persisted as slot_CPconfigdaemon.
- Stopping dynamic_server blocks escalation but disables DynamicCLI.
Impact: Local privilege escalation to root on Gaia appliances
| Product | Affected | Fixed in |
|---|---|---|
| Check Point Gaia OS | R82.20, R82.10, R82, R81.20, R81.10, and R81 | R82.20 Take 14, R82.10 Take 52, R82 Take 132, R81.20 Take 174 |
- 1.Install the listed Take fixes for supported Gaia branches.
- 2.Review /var/log/dynamicCli.log for commands missing the Clish wrapper.
- 3.Confirm /tmp/dynamic_socket is 0660 and owned by root:config.
- ATT&CK
- T1068 Exploitation for Privilege EscalationT1190 Exploit Public-Facing ApplicationT1505.003 Web ShellT1021.004 SSH
- Vendors
- Check Point
- Products
- Gaia OSMobile Access
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-123039 | Local root command execution via Gaia OS DynamicCLI socket | 7.8 | 1% | KEV | KEV |
From the original article
2 min read at gbhackers.com
CISA has reportedly added CVE-2026-123039, a Check Point Gaia OS permission flaw, to its Known Exploited Vulnerabilities catalog following active exploitation. The entry supplied for this report lists November 13, 2026, as the addition date and November 16 as the remediation deadline. Check Point exploitation reporting nevertheless identifies compromised customers and a practical route from […]
By Eswar · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.