Description
The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| checkpoint | Quantum Security Gateway | R82.10 with Jumbo Hotfix Take 50 or below, R82.20 with Jumbo Hotfix Take 10 or below, R82 with Jumbo Hotfix Take 130 or below, R81.20 with Jumbo Hotfix Take 173 or below | — |
| checkpoint | Quantum Security Management | R82.10 with Jumbo Hotfix Take 50 or below, R82.20 with Jumbo Hotfix Take 10 or below, R82 with Jumbo Hotfix Take 130 or below, R81.20 with Jumbo Hotfix Take 173 or below | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
googlesky/CVE-2026-123039 ★ 3 · Nov 13, 2026
Containerised PoC for CVE-2026-123039: the Check Point Gaia OS Dynamic CLI daemon publishes /tmp/dynamic_socket world-writable and authenticates no caller, so any local user escalates to root. Differ…
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- WID-SEC-2026-4562 Check Point Security Management und Security Gateway: Mehrere Schwachstellen ermöglichen Erlangen von Administratorrechten BSI CERT-Bund (WID) · Nov 12, 2026