CISA has added CVE-2026-123039 to its Known Exploited Vulnerabilities catalog, confirming active exploitation of a Check Point Gaia OS privilege escalation flaw that lets an authenticated local user execute commands as root.
What Is It
CVE-2026-123039 is an incorrect permission assignment for a critical resource (CWE-732) combined with missing authorization (CWE-862). In Gaia OS, the DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket). It does not authenticate the processes that connect to it. An authenticated local user can send a command to the socket, and the daemon runs it as root.
Check Point rates it CVSS 3.1 7.8 (HIGH) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. That means local access, low complexity, low privileges required and no user interaction, with high impact to confidentiality, integrity and availability.
Why It Matters
CISA added the flaw to the KEV catalog on 2026-11-13, which confirms it is being exploited in the wild. CISA's SSVC assessment marks exploitation as active, technical impact as total, and automatable as no. Whether it has been used in ransomware campaigns is listed as Unknown.
The entry is flagged for forensic triage, so under BOD 26-04 covered agencies must follow CISA's Forensics Triage Requirements as well as remediate. The remediation deadline is 2026-11-16, three days after the listing.
These devices are Check Point security gateways and management servers. Anyone with a low-privileged foothold on one of them can gain full root control.
What's Vulnerable
CISA lists the affected products as Check Point Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway and Security Management Server.
The NVD record lists these affected versions for Quantum Security Gateway and Quantum Security Management:
- R82.20 with Jumbo Hotfix Take 10 or below
- R82.10 with Jumbo Hotfix Take 50 or below
- R82 with Jumbo Hotfix Take 130 or below
- R81.20 with Jumbo Hotfix Take 173 or below
NVD analysis of the record is still in progress ("Undergoing Analysis").
Patch Status
Check Point has published advisory sk1000362. CISA's required action is to apply mitigations according to the vendor's instructions, in line with BOD 26-04 and CISA's Forensics Triage Requirements. For cloud services, follow the applicable BOD 26-04 guidance. If mitigations are not available, stop using the product. Organizations should also check each affected asset's internet exposure.
Federal agencies covered by the directive must complete remediation by 2026-11-16. Administrators should use sk1000362 to find the fixed Jumbo Hotfix takes for their release.