Check Point Gaia DynamicCLI local socket privilege escalation to root (CVE-2026-123039)

What happened

On Gaia OS, the DynamicCLI daemon runs as root and listens on a world-writable local control socket at /tmp/dynamic_socket. The socket does not authenticate the process connecting to it, so an authenticated local user can send a command to the daemon and have it executed with root privileges. The published CVSS 3.1 score is 7.8 (High), with a local attack vector, low privileges, no user interaction and high impact on confidentiality, integrity and availability.

CISA's KEV entry and ENISA's EUVD record exploitation, with ENISA EUVD assessing that exploitation has been occurring since 2026-11-13. CISA's due date for required action is 2026-11-16. Check Point has not published a fixed version or a workaround in SK1000362.

Who is affected

Check Point Quantum Security Gateway and Quantum Security Management running Gaia OS with the following Jumbo Hotfix takes: R82.10 with Take 50 or below, R82.20 with Take 10 or below, R82 with Take 130 or below, and R81.20 with Take 173 or below. The affected products are typically deployed as the security gateways and management appliances that enforce and administer network security policy. The attack requires an authenticated local user on the Gaia host, so internet-facing exposure alone is not the entry point.

What to do now

1. Identify any Quantum Security Gateway or Quantum Security Management installations on the affected versions.
2. Check Point has not released a fixed version and no workaround is published in Check Point's SK1000362 advisory, so keep that advisory under review for the first available fix.
3. Reduce the local attack surface: remove or disable unnecessary local accounts, enforce multi-factor authentication for administrative access, and restrict SSH, console and local login to named staff.
4. Monitor the Gaia host for unexpected processes connecting to /tmp/dynamic_socket and for root-level commands spawned by the DynamicCLI daemon.
5. If local misuse is suspected, isolate the appliance from the network and begin incident response.

How to detect it

The exposed socket is /tmp/dynamic_socket. On Gaia hosts, review logs and process activity for unexpected connections to that socket or for the DynamicCLI daemon spawning root-level processes from non-administrative accounts.

Beyond the patch

An exploited local privilege escalation with no vendor fix shifts the immediate burden to detection and response. Managed Detection & Response (MDR) can monitor for the post-exploitation activity that follows a root-level compromise, and an Incident Response Retainer ensures a team is ready if a device is suspected to be affected. Supply Chain Defense & Third-Party Risk is also relevant for tracking Check Point's fix cycle alongside the other suppliers whose patch timelines set your exposure window.