A privilege escalation flaw in Check Point’s Gaia OS, tracked as CVE-2026-123039, lets a user who already has a local account on an affected device run commands as root. The DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket). It does not check who is connecting, so any authenticated local user can send it a command and have that command executed with full root privileges.
The vulnerability affects Check Point Quantum Security Gateway and Quantum Security Management on several R81.20 and R82-series releases. It carries a CVSS 3.1 score of 7.8 (High). CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on 13 November 2026, which means attackers are already using it. Administrators should treat it as urgent.
What’s affected
The NVD record lists the following versions as affected, for both Quantum Security Gateway and Quantum Security Management:
- R82.20 with Jumbo Hotfix Take 10 or below
- R82.10 with Jumbo Hotfix Take 50 or below
- R82 with Jumbo Hotfix Take 130 or below
- R81.20 with Jumbo Hotfix Take 173 or below
CISA’s KEV entry describes the affected products more broadly: Check Point Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway, and Security Management Server. Administrators running any of these on Gaia OS should check Check Point’s advisory (sk1000362) to confirm whether their deployment is in scope.
The records list affected versions but do not name specific fixed Jumbo Hotfix takes. The advisory data doesn’t yet confirm which versions contain the fix, so check Check Point’s advisory for the exact remediated builds.
How serious is it
Check Point, the CVE Numbering Authority, assigned a CVSS 3.1 base score of 7.8 (High), vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. In plain terms:
- Local attack vector (AV:L): the attacker needs local access to the device, such as a shell account. The flaw cannot be triggered directly over the network.
- Low complexity, low privileges (AC:L/PR:L): any ordinary authenticated local user can exploit it, with no special conditions.
- No user interaction (UI:N): no administrator has to do anything for the attack to work.
- High impact on confidentiality, integrity and availability (C:H/I:H/A:H): root access gives full control of the gateway or management server.
The weaknesses are classified as CWE-732 (Incorrect Permission Assignment for Critical Resource) and CWE-862 (Missing Authorization). Because these devices sit at the heart of network security, a compromised gateway or management server can undermine the protection of the whole environment. A local-only flaw like this is especially dangerous when paired with another way into the device, such as stolen credentials.
Is it being exploited?
Yes. CISA added CVE-2026-123039 to its KEV catalog on 13 November 2026, confirming active exploitation. Whether it has been used in ransomware campaigns is listed as unknown.
US federal civilian agencies must act by 16 November 2026. CISA’s required action is to apply mitigations in line with vendor instructions, following BOD 26-04 (Prioritizing Security Updates Based on Risk) and CISA’s Forensics Triage Requirements. Agencies should discontinue use of the product if mitigations are unavailable. That deadline is only three days after the listing, which signals how urgent CISA considers the threat.
What to do
- Apply Check Point’s fix: follow the instructions in Check Point advisory sk1000362. Install the Jumbo Hotfix take it identifies for your release.
- Inventory your devices: find every Gaia-based gateway, management server, Multi-Domain server and Scalable Platform, and check each one’s release and Jumbo Hotfix take against the affected list.
- Limit local access: review who holds shell or local accounts on these devices. Remove unneeded accounts and rotate credentials, especially for administrative interfaces exposed to untrusted networks.
- Look for signs of compromise: exploitation is confirmed, so review devices for unexpected accounts, configuration changes or root-level activity. Use CISA’s forensics triage guidance as a starting point.
- Disconnect if you can’t mitigate: CISA’s guidance is to stop using the product if mitigations are unavailable.
