Skip to content
NewA calmer, faster ZeroHour
Exploit / PoChighExploited in the wild

CISA lists Check Point local root flaw as exploited (CVE-2026-123039)

Original title: CISA KEV: Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability — Check Point Multiple Products (CVE-2026-123039)

CISA Known Exploited Vulnerabilities ()1 min read1
Read at cisa.gov
Part of a story covered by 14 sourcesAttackers rooted Check Point gateways and wiped some ESXi hostsMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

Gaia DynamicCLI accepts unauthenticated local commands as root; the federal due date is November 16, 2026.

CISA added CVE-2026-123039, an incorrect permission assignment in several Check Point products, to the Known Exploited Vulnerabilities catalog. The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket without authenticating connecting processes. An authenticated local user can send a command that executes as root. Agencies must apply vendor mitigations under BOD 26-04 by November 16, 2026, or stop using the product.

Unconfirmed: Affected and fixed versions are not stated, and ransomware use is unknown.

Key facts
  • Affected products include Firewall, Security Gateway, and Security Management Server.
  • Multi-Domain Security Management Server and Scalable Platforms are also named.
  • The socket does not authenticate connecting processes.
  • Known ransomware campaign use is listed as unknown.
Security assessment · AI, from the articleExploited in the wild

Impact: Authenticated local user executes commands as root

ProductAffected
Check Point Firewall—
Check Point Multi-Domain Security Management Server—
Check Point Scalable Platforms—
Check Point Security Gateway—
Check Point Security Management Server—
What to do
  1. 1.Apply vendor mitigations and follow CISA BOD 26-04 guidance.
  2. 2.Complete CISA forensics triage requirements.
  3. 3.Discontinue use if mitigations are unavailable.
Analyze CVE-2026-123039 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-123039
ATT&CK
T1068 Exploitation for Privilege Escalation
Tags
check-pointgaiaprivilege-escalationcisa-kevfirewall
Vendors
Check Point
Products
FirewallMulti-Domain Security Management ServerScalable PlatformsSecurity GatewaySecurity Management ServerGaia OS
Organizations
CISA

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-123039
Local root command execution via Gaia OS DynamicCLI socket
7.81%KEV
KEV

From the original article

1 min read at cisa.gov

Check Point Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway, and Security Management Server contain an incorrect permissions assignment for critical resources vulnerability when the Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket without authenticating connecting processes.

CISA Known Exploited Vulnerabilities

cisa.gov

Read the full article at CISA Known Exploited Vulnerabilities

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.