Check Point Gaia DynamicCLI Local Privilege Escalation (CVE-2026-123039) Added to CISA KEV

What happened

CISA has added CVE-2026-123039 to its Known Exploited Vulnerabilities (KEV) catalog. It affects multiple Check Point products running Gaia OS: Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway, and Security Management Server. Per Check Point's advisory (sk1000362), the Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket. The daemon does not authenticate connecting processes. An authenticated local user can send a command to that socket and have it executed as root.

Why it matters

This is a local privilege escalation, not a remote exploit. The KEV listing indicates active exploitation. Any foothold that grants a low-privileged local session can be escalated to full root on the appliance. Given the affected product lines, Security Management Servers and Multi-Domain Management Servers that manage fleets of gateways are especially consequential if root is obtained.

What defenders should do now

• Check Check Point's advisory (sk1000362) for patched Gaia OS build numbers and apply them to all affected roles, including gateways, management servers, and scalable platform members.
• Inventory which users and service accounts have local shell or CLI access to Gaia appliances. This flaw requires an authenticated local session, so limiting local access reduces exposure pending patching.
• Hunt for unexpected processes connecting to or writing to the DynamicCLI socket, and for root-owned process spawns that follow a non-root login.
• Review audit and command logs on Gaia devices for privilege anomalies around the time local sessions were established.

Still developing

Details on in-the-wild exploitation such as actor, campaign, and prevalence have not been disclosed beyond the KEV listing. Known ransomware campaign use is currently marked unknown. Check Check Point's official advisory for authoritative patch guidance and updates: https://support.checkpoint.com/results/sk/sk1000362.