Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-123039 |
| Alert Source | CISA KEV - Active Exploitation |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-13 |
| Vendor | Check Point |
| Product | Gaia OS: Firewall, Security Gateway, Scalable Platforms, Security Management Server, Multi-Domain Security Management Server |
| CVSS Score | 7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| EPSS Score | 1.3% (percentile: 70%) |
| CISA KEV | Yes - confirmed active exploitation |
| Ransomware | Not confirmed |
| Remediation Deadline | 2026-11-16 |
Vulnerability Description
Source: CISA KEV, NVD
The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (
/tmp/dynamic_socket) without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root.
The flaw affects Check Point appliances and management servers running Gaia OS: Firewall, Security Gateway, Scalable Platforms, Security Management Server and Multi-Domain Security Management Server. It requires local access with low privileges, so an attacker who already has an account on the device (or has taken over a limited administrator account) can gain full control of the gateway or management server. CISA has added the flaw to the KEV catalog, which means exploitation in attacks has been confirmed.
Required Actions
- Apply patches or mitigations according to Check Point’s instructions for this vulnerability (CISA refers to the vendor’s guidance).
- Limit the number of accounts with Gaia OS shell access and review who has local access to gateways and management servers.
- Review device logs for unusual local sessions and unexpected configuration changes.
- If mitigations are unavailable, CISA advises discontinuing use of the product. For US federal agencies the deadline follows from directive BOD 26-04; for other organisations it is a signal of urgency, not an obligation.
Who Is Affected?
This vulnerability affects organisations using Check Point gateways and management servers running Gaia OS. Check the system versions on all appliances and management servers and the patch status in the Check Point support portal.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
