CVE-2026-123039: Check Point Gaia DynamicCLI World-Writable Socket Gives Local Users Root

Background

Gaia is the operating system on Check Point firewalls and management servers. Its Dynamic CLI adds “Expert” mode commands to Gaia Clish and is served by a root process, dynamic_server, over a local socket at /tmp/dynamic_socket. Check Point’s advisory (sk1000362) says the socket is created world-writable (0777) with no authentication of the connecting process, and that dynamic_server executes whatever command string it receives as root.

Check Point states it “observed an active exploit of this vulnerability against a couple of dozen customers”. CISA added the CVE to KEV on 13 November 2026.

Technical Mechanism

CISA classes the flaw as CWE-732 (Incorrect Permission Assignment for Critical Resource) and CWE-862 (Missing Authorization). Any authenticated local user can write a single request to /tmp/dynamic_socket; the root daemon runs the command string. No exploit chain beyond local code execution is needed.

This is a local privilege escalation. Check Point says the attacker must already have local code execution on the appliance. Our judgement is that the practical risk comes from pairing it with any initial foothold, such as a low-privilege account or a separate web or service flaw; we have no source naming the foothold used in the observed attacks.

Check Point, the CNA, scores it CVSS 3.1 7.8, vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. NVD lists the same 7.8 as a secondary score from [email protected]; NVD’s own analysis was still pending when checked on 14 November 2026.

Real-World Exploitation Evidence

• Check Point’s advisory (last modified 12 November 2026) reports active exploitation against “a couple of dozen customers”. It does not name an actor or an initial-access method in the text we read.
• CISA added CVE-2026-123039 to KEV on 13 November 2026, due 16 November 2026. Forensic triage is “Yes”; ransomware use is “Unknown”.
• As of 14 November 2026 we found no named threat actor or campaign in the Check Point advisory or the KEV entry.

Impact Assessment

Root on a Check Point gateway or management server gives control of the security enforcement point: rule sets, VPN configuration, credentials and keys, and logs. On a management server, it can reach every managed gateway. Our judgement is that these are the reasons CISA requested forensic triage.

Check Point lists Spark firewalls and Smart-1 Cloud as not affected.

Affected Versions

Affected products as named in the Check Point advisory (the CNA record uses “Quantum Security Gateway” and “Quantum Security Management” for the same lines): Force Firewalls, Management and Log Servers, Multi-Domain Security Management and Multi-Domain Log Server, and Maestro Orchestrator. The CNA record’s take thresholds are one below the fix Takes in the advisory.

Remediation Steps

1. Install the Jumbo Hotfix Accumulator at or above the fixed Take for your release (table above).
2. Until patched, disable the daemon: run dbset process:dynamic_server then dbset :save. Dynamic CLI commands listed in sk144112 then fail. To re-enable, run dbset process:dynamic_server t and dbset :save.
3. Confirm the fix: ls -l /tmp/dynamic_socket should show srw-rw---- root config (0660), not srwxrwxrwx (0777).
4. Follow CISA KEV and BOD 26-04 forensic triage requirements. Check for compromise before or while patching.

Detection Guidance

From Check Point’s advisory. The daemon logs every command it receives to /var/log/dynamicCli.log; legitimate requests use a Clish wrapper beginning . /opt/CPshared/5.0/tmp/.CPprofile.sh >> /dev/null; export SP_DISTRIBUTE=0; set -o noglob;.

• Commands without that wrapper: grep "Received =" /var/log/dynamicCli.log | grep -vF "CPprofile.sh >> /dev/null; export SP_DISTRIBUTE=0; set -o noglob;"
• Use of the system() sink: grep -F "Received = #return_value#" /var/log/dynamicCli.log
• Exploitation-style commands (id, whoami, /etc/shadow, nc, /dev/tcp, curl, wget, base64, useradd, authorized_keys): Check Point supplies a grep -EI pattern in sk1000362.
• On patched systems: grep "Rejected connection from unauthorized uid" /var/log/dynamicCli.log shows blocked attempts; an unexpected UID such as 99 (nobody) indicates an attempt.

Run these on each firewall or cluster member.

Timeline

References

• Check Point sk1000362
• Check Point sk144112 (Dynamic CLI)
• CVE record
• NVD: CVE-2026-123039
• CISA KEV catalog