Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability

🚨SEVERITY: HIGH — CVSS 7.8Security Advisory

TL;DR 📌

  • Check Point Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway, and Security Management Server contain an incorrect permissions assignment for critical resources vulnerability when the Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket without authenticating connecting processes. An authenticated local user can send a command to the socket…
  • Highest CVSS: 7.8 (High).
  • Listed in CISA KEV (2026-11-13) — this is being exploited in the wild.
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2026-123039.

What it is

CVE-2026-123039 is a local privilege escalation vulnerability in Check Point’s Gaia OS, affecting Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway, and Security Management Server. It sits in the DynamicCLI daemon, which runs as root and listens on a local Unix socket at /tmp/dynamic_socket.

The socket is world-writable and the daemon does not authenticate the processes connecting to it. Any authenticated local user — not just root or an administrator — can write a command to the socket and have DynamicCLI execute it with root privileges.

The access path is local only: an attacker needs an existing low-privileged session on the Gaia appliance (CVSS vector confirms AV:L, PR:L, no user interaction required). This is not a remote or unauthenticated network issue; it’s a mechanism for escalating from a standard local account to full root control once a foothold exists. Given the breadth of affected products, this covers Check Point’s core gateway and management platforms rather than a single appliance type.

CVE-2026-123039 is listed in CISA’s Known Exploited Vulnerabilities catalogue, added 13 November 2026.

What to do

  • Check Check Point’s advisory for this CVE directly; fixed version numbers are not included here, so confirm the patched Gaia OS release for your specific product line (Security Gateway, Security Management Server, Multi-Domain Server, or Scalable Platforms) before planning remediation.
  • Given the KEV listing, treat this as a priority patching action rather than routine maintenance — schedule the update promptly once the fixed release is confirmed.
  • In the interim, review who holds local authenticated access to Gaia OS appliances. Since any local account can trigger the escalation, tighten local account provisioning and remove unnecessary shell or CLI access where possible.
  • Check for unusual activity involving /tmp/dynamic_socket or unexpected root-level actions following local logins, as part of standard log review until patched.
  • After patching, verify that the DynamicCLI daemon’s socket permissions have actually changed — confirm the fix addresses the authentication gap rather than just the daemon version.

For leadership 🧭

Executive summary. Any standard local account on affected Check Point gateways and management servers can escalate to root by writing to an unprotected daemon socket, and this is already listed as a known exploited vulnerability. Because it affects core gateway and management platforms, treat patching as urgent rather than routine.

Why it matters:

  • The DynamicCLI daemon on Gaia OS runs as root and listens on /tmp/dynamic_socket, which is world-writable and does not check who is connecting.
  • Any authenticated local user, not just administrators, can write a command to that socket and have it executed with root privileges.
  • Affected products span Firewall, Security Gateway, Security Management Server, Multi-Domain Security Management Server and Scalable Platforms, so the exposure sits across core gateway and management infrastructure.
  • CVE-2026-123039 is in CISA’s Known Exploited Vulnerabilities catalogue, added 13 November 2026.

Now / Next / Later:

  • Now: Review who currently holds local authenticated access to Gaia OS appliances and restrict or remove unnecessary shell or CLI accounts while a fix is confirmed.
  • Next: Obtain the fixed Gaia OS release for your specific product line from Check Point and schedule the update as a priority patching action given the KEV listing.
  • Later: After patching, verify that DynamicCLI’s socket permissions and authentication have genuinely changed, and build routine checks for unexpected root-level activity following local logins into standard log review.

Source