CISA Adds Check Point Gaia Privilege Escalation Flaw to KEV Catalog

The Cybersecurity and Infrastructure Security Agency added CVE-2026-123039, a privilege-escalation flaw in the Check Point Gaia OS, to its Known Exploited Vulnerabilities (KEV) catalog on November 13, 2026, after evidence it is already being exploited in the wild. The bug lives in Gaia's DynamicCLI daemon, which runs as root and listens on a local socket that is world-writable and does not authenticate the processes connecting to it — letting any authenticated local user send it a command and have that command run as root. CISA has set a remediation deadline of November 16, 2026, just three days after the catalog addition.

What CISA Added, and Why It Matters

CVE-2026-123039 is now one of the newest entries in the KEV catalog, the list CISA maintains of vulnerabilities it has confirmed are being actively exploited. According to the KEV JSON feed CISA publishes, the flaw affects "Check Point Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway, and Security Management Server," and occurs "when the Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket without authenticating connecting processes." The practical result, per CISA's own description: "An authenticated local user can send a command to the socket and have it executed as root."

That framing matters. This is not a remote, unauthenticated takeover — an attacker needs some form of local access to the Gaia appliance first, whether through a valid low-privilege account, a compromised management session, or another initial-access vector. But once that foothold exists, the DynamicCLI socket (publicly documented as living at /tmp/dynamic_socket) turns a low-privilege local session into full root control of the firewall or security-management box, which is about as severe an escalation as exists on a perimeter security appliance.

What Gaia OS Is, and Why a Local Socket Bug There Matters

Gaia is Check Point's own term for its unified operating system, described in the company's Gaia administration guide as "the Check Point next generation operating system for security applications," running across the full range of Check Point software blades, security gateways, and security management products. Because Gaia is the common OS underpinning most of Check Point's current appliance lineup — firewalls, multi-domain management servers, scalable platforms, and standalone security-management servers alike — a flaw in a core Gaia daemon like DynamicCLI has the potential to reach a wide swath of a customer's estate at once, rather than being confined to a single product line. DynamicCLI itself is the internal mechanism Gaia uses to apply dynamic configuration-management commands; CISA's and NVD's descriptions both confirm it runs with root privileges by design, which is precisely why an authentication gap on its control socket is so consequential.

Inside CVE-2026-123039: The Technical Details

The National Vulnerability Database entry for CVE-2026-123039, submitted by Check Point's own CVE Numbering Authority (sourceIdentifier [email protected]), describes the bug in similar terms: "The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root."

NVD published the record on November 12, 2026 at 14:17 UTC, roughly a day before CISA's KEV addition, and as of this writing the entry carries a status of "Undergoing Analysis" while NVD finalizes its own metadata. The CVSS v3.1 base score supplied with the submission is 7.8 (High), built from the vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H: a local attack vector, low complexity, low privileges required, no user interaction needed, and high impact to confidentiality, integrity, and availability once exploited. NVD's exploitability sub-score is 1.8 and its impact sub-score is 5.9 — a profile typical of local privilege-escalation bugs that are easy to trigger once an attacker has any foothold at all.

NVD also lists two CWE classifications for the flaw: CWE-732 (Incorrect Permission Assignment for Critical Resource) and CWE-862 (Missing Authorization) — a combination that lines up precisely with the root cause CISA and Check Point both describe: a sensitive control socket with permissions and authentication checks that were never locked down.

Under NVD's Stakeholder-Specific Vulnerability Categorization (SSVC) data, a CISA coordinator recorded the vulnerability's exploitation status as "active," its automatability as "no," and its technical impact as "total," which is consistent with both the KEV listing and the urgency of the three-day remediation window.

Which Check Point Products Are Affected

Check Point's own submission to NVD lists the affected products as Quantum Security Gateway and Quantum Security Management, across several Gaia-based release trains, each capped at a specific Jumbo Hotfix Accumulator (JHF) "Take" level:

The KEV catalog's own product description casts a slightly wider net, naming "Check Point Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway, and Security Management Server" — reflecting that the underlying Gaia OS component is shared across most of Check Point's current security-appliance lineup, not just the two product names NVD lists explicitly. Administrators running any Gaia-based Check Point deployment should confirm their specific build and hotfix level against Check Point's advisory rather than assume they are unaffected based on product name alone.

Remediation Guidance and the November 16 Deadline

CISA's KEV entry directs organizations to "apply mitigations in accordance with vendor instructions," while flagging a compliance link to a newer directive than the one security teams may be used to. Rather than citing the familiar Binding Operational Directive 22-01, this entry's required action is tied to Binding Operational Directive 26-04, "Prioritizing Security Updates Based on Risk", along with CISA's accompanying "Forensics Triage Requirements" guidance. The entry's exact text reads: "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA's 'Forensics Triage Requirements.' Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines."

The KEV record also flags this entry for forensic triage ("forensicTriage": "Yes"), a designation CISA reserves for vulnerabilities where it wants affected federal entities to also preserve forensic artifacts and evidence of potential compromise, not just patch and move on. Practically, that is a sign CISA believes exploitation of CVE-2026-123039 in the wild may already have compromised some systems, and it wants agencies checking for signs of prior intrusion in addition to closing the hole.

The November 16, 2026 due date gives covered organizations roughly three days from the catalog addition to remediate — a notably tighter window than the 21-day default historically associated with the KEV program, underscoring how CISA's risk-based BOD 26-04 framework can compress timelines for vulnerabilities it judges especially urgent. While BOD 26-04 compliance is a mandate for U.S. federal civilian executive branch agencies specifically, CISA has consistently urged all organizations running affected software, in any sector, to treat KEV additions as a signal to patch on the same accelerated timeline regardless of the legal requirement.

For remediation specifics — which Jumbo Hotfix Accumulator Take level resolves the issue on each release train — administrators should consult Check Point's own advisory for this vulnerability (sk1000362), referenced in both the NVD and CISA KEV records.

Ransomware Use and Exploitation Status

CISA's KEV entry lists knownRansomwareCampaignUse as "Unknown" for CVE-2026-123039. That field is distinct from the "actively exploited" determination that got the CVE onto the KEV list in the first place: CISA only adds vulnerabilities to KEV when it has confirmed evidence of exploitation, but it separately tracks whether that exploitation has been tied to a known ransomware operation. An "Unknown" rating here means CISA has not (yet) attributed observed exploitation of this flaw to a named ransomware group or campaign — it is neither confirmed ransomware use nor ruled out.

Because the vulnerability requires local, authenticated access rather than remote unauthenticated access, it is best understood as a post-compromise escalation tool: an attacker who has already gained a low-privileged foothold on a Gaia-based Check Point appliance, through credential theft, a separate initial-access vulnerability, or insider misuse, can use CVE-2026-123039 to escalate that foothold to full root control. That profile is consistent with how ransomware affiliates and other intrusion actors commonly chain vulnerabilities: an initial-access bug or stolen credential gets them in the door, and a local privilege-escalation bug like this one gets them root.

How This Differs From Check Point's September KEV Entry

This is Check Point's second distinct appearance on the KEV catalog in recent months. In September, CISA added two other Check Point vulnerabilities — CVE-2026-93616 and CVE-2026-85102 — to the list. Those were separate flaws with their own CVE identifiers, affected components, and exploitation mechanics. CVE-2026-123039 is a new, unrelated vulnerability specific to the Gaia OS DynamicCLI daemon and the permissions on its local control socket; it was not disclosed, scored, or added to KEV until November 2026, months after the September entries. Organizations that already remediated the September flaws should treat this as a separate patching action, not a re-confirmation of earlier fixes.

How CVE-2026-123039 Fits the Broader KEV Pattern

CISA's KEV catalog has become one of the most closely watched vulnerability-prioritization tools in security operations precisely because every entry requires confirmed, real-world exploitation evidence — unlike CVSS scores or vendor severity ratings, which reflect theoretical risk. Local-privilege-escalation bugs in security appliances' management planes have been a recurring KEV category this year, following the same pattern seen in other recent additions, such as the IBM Aspera Faspex flaw added to the KEV catalog earlier this cycle. In each case, the common denominator is a vendor security or management appliance with a flaw that converts limited access into full administrative control — exactly the kind of foothold attackers prize once they are inside a network perimeter.

What's Next

Expect Check Point to continue updating its support-center advisory (sk1000362) as it refines detection guidance and hotfix availability across its Gaia-based release trains, and for NVD to finalize its analysis status on CVE-2026-123039 in the coming days. Security teams running Check Point Quantum Security Gateway or Security Management on Gaia OS should treat November 16 as the operational deadline regardless of sector, verify their current Jumbo Hotfix Accumulator Take level against Check Point's advisory, and apply the vendor's fix rather than waiting for further KEV updates. This story will be updated if Check Point publishes additional guidance or if CISA revises the catalog entry's due date or ransomware-use designation.

For broader protection against the kind of credential and access abuse that often precedes a local privilege-escalation exploit like this one, see Pandromeda's guide to locking down exposed accounts after a breach.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage