CVE-2026-123039: Check Point Gaia OS DynamicCLI Root Privilege Escalation — Detection and Remediation Guide

On November 13, 2026, CISA added CVE-2026-123039 to the Known Exploited Vulnerabilities (KEV) catalog, confirming what many of us in the incident response trenches have been tracking: active, in-the-wild exploitation of a critical local privilege escalation vulnerability in Check Point's Gaia operating system. This is not a theoretical risk. Threat actors are leveraging this flaw right now to escalate privileges from authenticated local user to root on affected Check Point security infrastructure.

The vulnerability resides in the DynamicCLI daemon, which runs with root privileges and listens on a world-writable local socket without authenticating connecting processes. For organizations running Check Point Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway, or Security Management Server, this represents a direct path to complete system compromise. If an attacker gains any level of local access—whether through a separate vulnerability, compromised credentials, or an insider threat—they can leverage this flaw to execute arbitrary commands as root, bypassing security controls, manipulating firewall policies, exfiltrating sensitive configurations, and establishing persistent access to your network perimeter.

CISA's Binding Operational Directive (BOD) 26-04 mandates immediate action. This isn't a patch-when-convenient scenario. If you operate Check Point infrastructure, treat this as an emergency change window.

Technical Analysis

Affected Products and Platforms

CVE-2026-123039 impacts the following Check Point products running the Gaia operating system:

• Check Point Firewall
• Multi-Domain Security Management Server (MDS)
• Scalable Platforms (Maestro/SP)
• Security Gateway
• Security Management Server (SMS)

The vulnerability is platform-agnostic within the Gaia OS ecosystem, affecting both hardware appliances and virtualized instances (VMware, KVM, Hyper-V, Azure, AWS, GCP) where the vulnerable DynamicCLI daemon is deployed.

Vulnerability Mechanics

The flaw is classified under CWE-732: Incorrect Permission Assignment for Critical Resource. The DynamicCLI daemon (dynamic_cli) is designed to provide local command-line interface functionality. However, it fails in three critical ways:

1. Excessive Privileges: The daemon runs as the root user (UID 0).
2. Insecure IPC Endpoint: It creates a local Unix domain socket with world-writable permissions (typically /tmp/.dynamic_cli.sock or similar, depending on the specific Gaia version and configuration).
3. Missing Authentication: The daemon does not verify the identity or authorization of processes connecting to this socket. It blindly accepts commands from any local user.

An authenticated local user—even one with a low-privileged shell such as admin or a service account—can connect to this socket using standard tools like socat or nc and send commands that are executed with root privileges. This is a classic confused deputy problem: the daemon acts as a privileged proxy for unprivileged users.

Exploitation Status

CONFIRMED ACTIVE EXPLOITATION. CISA's KEV listing is not speculative; it is based on verified reports of exploitation in the wild. While Check Point has not disclosed the full scope of the campaigns leveraging this vulnerability, the KEV designation implies that threat actors are successfully using this flaw to gain root access to perimeter security devices. Given the nature of Check Point deployments—typically at network boundaries—this provides attackers with a beachhead for lateral movement, traffic interception, and policy manipulation.

No public proof-of-concept code has been observed as of this writing, but the KEV listing indicates that exploit code is likely circulating in private channels or being used by sophisticated actors. Assume breach if you have unpatched systems with local user access enabled.

Detection & Response

Detecting exploitation of CVE-2026-123039 requires visibility into local process execution, socket connections, and command invocation on your Check Point appliances. Standard network IDS will not catch this; you need host-based telemetry or comprehensive syslog forwarding to your SIEM.

SIGMA Rules

Deploy these Sigma rules to your Linux and network device detection pipelines. Note that Gaia OS is Linux-based; process creation logs can be ingested via syslog or endpoint agents if deployed.

---
title: Check Point Gaia DynamicCLI Socket Connection
id: 8f3e2a1b-9c4d-4e5f-8a6b-7c8d9e0f1a2b
status: experimental
description: Detects local connections to the DynamicCLI daemon socket, which may indicate exploitation of CVE-2026-123039.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/11/13
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine|contains:
      - '/tmp/.dynamic_cli.sock'
      - 'dynamic_cli.sock'
      - 'socat'
      - 'nc -U'
  condition: selection
falsepositives:
  - Legitimate administrative troubleshooting by network engineers
level: high
---
title: Check Point Gaia Suspicious Root Command Execution
id: 2a4b6c8d-0e2f-4a6b-8c0d-2e4f6a8b0c2d
status: experimental
description: Detects execution of shell commands by the dynamic_cli process or unexpected root-level process spawning.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/11/13
tags:
  - attack.privilege_escalation
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|contains: 'dynamic_cli'
    Image|contains:
      - '/bin/sh'
      - '/bin/bash'
      - '/usr/bin/python'
      - '/usr/bin/perl'
  condition: selection
falsepositives:
  - Check Point automated maintenance scripts (rare)
level: critical
---
title: Check Point Gaia World-Writable Socket Creation
id: 9f8e7d6c-5b4a-3c2d-1e0f-9a8b7c6d5e4f
status: experimental
description: Detects creation of world-writable sockets in /tmp, a hallmark of this vulnerability's insecure IPC mechanism.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/11/13
tags:
  - attack.persistence
  - attack.t1543
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|startswith: '/tmp/'
    TargetFilename|endswith: '.sock'
    Permissions: '666'
  condition: selection
falsepositives:
  - Legitimate but poorly coded applications (investigate immediately)
level: high

KQL (Microsoft Sentinel / Defender)

If you are forwarding Check Point syslog or using a Linux auditing integration (like Auditd or Sysmon for Linux) into Microsoft Sentinel, use these queries to hunt for exploitation attempts.

// Hunt for connections to DynamicCLI socket via common tools
Syslog
| where Facility == "user" or Facility == "local0"
| where ProcessName in ("socat", "nc", "ncat")
| where SyslogMessage contains "dynamic_cli" or SyslogMessage contains "/tmp/.dynamic_cli.sock"
| project TimeGenerated, Computer, ProcessName, SyslogMessage, HostIP
| order by TimeGenerated desc

// Hunt for dynamic_cli spawning shells or unexpected child processes
DeviceProcessEvents
| where InitiatingProcessFileName contains "dynamic_cli"
| where FileName in ("sh", "bash", "dash", "python", "perl", "php")
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine, ProcessCommandLine, AccountName
| order by TimeGenerated desc

// Hunt for suspicious file permission changes on sockets (if file events are ingested)
DeviceFileEvents
| where FolderPath startswith "/tmp/"
| where FileName endswith ".sock"
| where FileOriginReferrerUrl contains "dynamic_cli" or InitiatingProcessFileName contains "chmod"
| where FileSize == 0 // Typical for sockets
| project TimeGenerated, DeviceName, FileName, FolderPath, InitiatingProcessCommandLine

Velociraptor VQL

For DFIR teams responding to a suspected compromise, this Velociraptor artifact will identify active connections to the vulnerable socket and enumerate processes with open handles to it.

-- Hunt for processes connected to the DynamicCLI socket
SELECT Pid, Name, Exe, CommandLine, Username, 
       netstat(Pid=Pid) as NetworkConnections
FROM pslist()
WHERE CommandLine =~ 'dynamic_cli' 
   OR Name =~ 'socat|nc|ncat'
   OR (NetworkConnections.Path =~ 'dynamic_cli' AND NetworkConnections.Type == 'unix')

Remediation Script (Bash)

Use this Bash script on your Gaia OS appliances to verify current permissions, check for suspicious processes, and apply temporary mitigations if patching must be delayed. Note: This does not patch the vulnerability; it only detects and restricts access. Apply the official Check Point hotfix immediately.

#!/bin/bash
# CVE-2026-123039 Detection and Temporary Mitigation Script
# Run on Check Point Gaia OS

LOGFILE="/var/log/cve-2026-123039-check.log"
echo "[$(date)] CVE-2026-123039 Check Started" > $LOGFILE

# Check for DynamicCLI socket
SOCK_PATH=$(find /tmp -name "*dynamic_cli*" -type s 2>/dev/null)
if [ ! -z "$SOCK_PATH" ]; then
    echo "[ALERT] DynamicCLI socket found: $SOCK_PATH" >> $LOGFILE
    ls -la $SOCK_PATH >> $LOGFILE
    
    # Check permissions
    PERMS=$(stat -c "%a" $SOCK_PATH)
    if [ "$PERMS" == "666" ] || [ "$PERMS" == "777" ]; then
        echo "[CRITICAL] Socket is world-writable ($PERMS)" >> $LOGFILE
        
        # Temporary mitigation: Restrict permissions (may break legitimate functionality)
        # chmod 600 $SOCK_PATH
        # echo "[ACTION] Temporarily restricted permissions on $SOCK_PATH" >> $LOGFILE
    fi
fi

# Check for suspicious processes connected to the socket
echo "[INFO] Checking for suspicious processes..." >> $LOGFILE
lsof | grep dynamic_cli >> $LOGFILE 2>&1

# Check for dynamic_cli spawning shells
ps auxf | grep -E "(dynamic_cli|sh|bash|python|perl)" | grep -v grep >> $LOGFILE

# Check for recent logins (potential initial access vector)
last -n 20 >> $LOGFILE

echo "[$(date)] Check completed. Review $LOGFILE for findings."
echo "[IMPORTANT] Apply Check Point hotfix immediately. See: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk183336"

Remediation

Immediate Actions Required

1. Apply Vendor Patches: Check Point has released hotfixes for affected versions. Consult the Check Point Support Center and apply the relevant hotfix for your specific software version (R80.40, R81, R81.10, R81.20, R82, etc.). Do not rely on version assumptions; verify with show version all and cross-reference with the Check Point advisory.
2. Verify Installation: After patching, verify that the DynamicCLI daemon no longer listens on a world-writable socket, or that it now enforces authentication. Run the detection script above to confirm permissions are restricted.
3. Review Local Access: Audit all local user accounts on your Check Point appliances. Disable or remove unnecessary accounts. Ensure the admin account is not used for routine monitoring if a lower-privileged account suffices.
4. Network Segmentation: Ensure management interfaces (Gaia Portal, SSH) are not accessible from untrusted networks. Use dedicated management VLANs and jump boxes.
5. Enhanced Monitoring: Increase logging verbosity on Check Point appliances. Forward all logs to a SIEM. Specifically monitor for the execution of dynamic_cli and any socket connections to /tmp/.dynamic_cli.sock.

CISA BOD 26-04 Compliance

CISA's Binding Operational Directive 26-04 requires federal civilian executive branch agencies to remediate KEV vulnerabilities within specified timeframes. While BOD 26-04 applies to federal agencies, private sector organizations should treat this as a de facto standard. The deadline for this vulnerability is immediate—typically within 48-72 hours of KEV listing for critical perimeter devices.

Workarounds (If Patching is Delayed)

If you cannot patch immediately (e.g., change freeze, maintenance window constraints), implement these compensating controls:

• Restrict Local Access: Disable SSH access for non-essential users. Use role-based access control (RBAC) in Gaia to limit who can log in locally.
• Socket Restriction: If operationally feasible, modify permissions on the socket to restrict access to root only. Warning: This may break legitimate DynamicCLI functionality used by Check Point support scripts or clustering.
• Process Monitoring: Deploy a host-based IDS (HIDS) or auditd rules to alert on any process connecting to the DynamicCLI socket.

Long-Term Hardening

• Principle of Least Privilege: Review why the DynamicCLI daemon requires root privileges. If possible, reconfigure it to run under a dedicated service account with reduced capabilities (though this may require vendor support).
• Socket Hardening: Advocate for Check Point to move the socket to a restricted directory (e.g., /var/run/checkpoint/) with 0700 permissions and implement peer credential verification (SO_PEERCRED).
• Vulnerability Management: Integrate Check Point appliances into your regular vulnerability scanning program. Use authenticated scans to detect missing hotfixes promptly.

Conclusion

CVE-2026-123039 is a stark reminder that perimeter security devices themselves are high-value targets. The combination of root-level daemon privileges and insecure IPC mechanisms creates a direct path to total compromise. With active exploitation confirmed by CISA, there is no grace period. Verify your exposure, apply the vendor hotfix, and hunt for signs of compromise immediately.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub