Summary. On 13 November CISA added CVE-2026-123039 to its Known Exploited Vulnerabilities (KEV) catalog with a due date of 16 November. The flaw is in Check Point’s Gaia operating system, which runs on its firewalls and management servers. Check Point’s advisory says the Dynamic CLI daemon runs as root and listens on a world-writable local socket without authenticating callers, so any authenticated local user can have a command run as root. The vendor says it “observed an active exploit of this vulnerability against a couple of dozen customers.” No evidence found as of 14 November, in the Check Point advisory or the KEV entry, of a named actor, an initial-access method or a sector breakdown.
What the flaw is
Per Check Point, dynamic_server listens on /tmp/dynamic_socket, which is created with mode 0777 and runs whatever command string it receives as root. CISA classes it as CWE-732 (incorrect permission assignment) and CWE-862 (missing authorization). Check Point, as CNA, scores it CVSS 3.1 7.8 (local vector, low privileges). NVD lists the same score as a secondary entry from Check Point; its own analysis was still pending when we checked.
This is a local escalation, not a remote entry point. Check Point states that the attacker must already have local code execution on the appliance. Our assessment: the exploitation reported against customers means someone first obtained that foothold by another route, but neither source says how.
Who is affected
Check Point lists Force firewalls, management and log servers, Multi-Domain Security Management and Log Server, and Maestro Orchestrator on R81, R81.10, R81.20, R82, R82.10 and R82.20. Spark firewalls and Smart-1 Cloud are listed as not affected. The advisory gives fixes in Jumbo Hotfix Accumulator Take 14 (R82.20), 52 (R82.10), 132 (R82) and 174 (R81.20). It lists no fix for R81 and R81.10, which it marks end of support (EOS). The CVE record’s affected ranges differ slightly from the advisory’s fix thresholds (for example R82.10 Take 50 or below, against a fix at Take 52); follow the advisory.
Sector implications
Our assessment: these appliances enforce perimeter and segmentation policy for telecoms, utilities and other critical-infrastructure operators, and management servers hold policy for many gateways. Root on one is a strong position for an attacker. Check Point has not said which customers were hit, so sector exposure here is our reasoning, not victim reporting.
Recommended actions
- Patch. Install the Jumbo Hotfix Take listed above for your release. Confirm with
ls -l /tmp/dynamic_socket: a fixed system showssrw-rw---- root config, notsrwxrwxrwx. - Mitigate if you cannot patch yet. Check Point’s workaround stops the daemon (
dbset process:dynamic_server, thendbset :save). Dynamic CLI commands then fail until it is re-enabled (dbset process:dynamic_server t, thendbset :save); Check Point’s sk144112 lists the commands affected. - Hunt. Check Point says the daemon logs received commands to
/var/log/dynamicCli.log. Commands without its standard Clish wrapper, or using thesystem()sink, may indicate abuse; the advisory gives the grep patterns, written for each Force Firewall or Cluster member; management servers are also listed as affected, so run the checks there too. A third check greps for exploitation commands such asid,whoami,/etc/shadowandncat. On patched systems, “Rejected connection from unauthorized uid” lines mark blocked attempts. - Treat as a possible incident. CISA’s entry calls for forensic triage. Preserving logs before any reboot is our suggestion, not the advisory’s.
- Plan for end-of-support R81 and R81.10: the advisory lists no fix for them. Our inference: the workaround or an upgrade is then the only route.
What we do not know
No evidence found as of 14 November, in the Check Point advisory, the CVE record and the KEV entry, of a named threat actor, indicators beyond the log patterns above, or the number of compromised systems (Check Point gives only “a couple of dozen customers”). CISA lists known ransomware campaign use as “Unknown”.