Gaia OS root escalation exploited in wild

Actively exploited in the wild - CVE-2026-123039 is a high-severity local privilege escalation in Check Point Gaia OS that lets any authenticated local user execute arbitrary commands as root through the DynamicCLI daemon’s unauthenticated socket. No vendor fix has been confirmed, so restrict access to /tmp/dynamic_socket immediately.

Overview

Gaia OS is Check Point’s hardened operating system that underpins its Security Gateways and management servers. It runs a daemon called DynamicCLI as root. That daemon listens on a local socket at /tmp/dynamic_socket, and the socket is world-writable. The daemon does not check who is connecting before it acts on the commands it receives.

Because /tmp is writable by any local account, any user who can log in to the appliance can open a connection to that socket and send a command. The daemon runs as root, so the command runs as root too. There is no password prompt, no privilege check, and no user interaction required beyond the ability to log in.

The CVSS score is 7.8 (HIGH). The vector shows a local attack, low complexity, low privileges required, and no user interaction. In practice, the only precondition is a foothold on the box.

Impact

Any low-privileged local account on a Gaia appliance becomes root. That means an attacker who lands a limited shell, whether through a weak SSH credential, a misconfigured admin account, or a separate foothold, can escalate to full control of the appliance. From root on a Security Gateway or management server, an attacker can read and alter firewall policy, exfiltrate configuration and secrets, install persistence, and pivot into protected network segments. Because these devices sit at the trust boundary of the network, root on a gateway undermines the controls the device was deployed to enforce.

CISA has added this CVE to its Known Exploited Vulnerabilities catalog, confirming that attackers are using it rather than merely theorizing about it. The EPSS score of 1.3% reflects the narrow local precondition, but KEV status overrides that signal for prioritization.

Remediation and Mitigation

• Patch or contact the vendor. Apply the DynamicCLI fix from Check Point as soon as it is available, and check the vendor’s advisory for the exact Gaia OS builds affected.
• Harden the socket now. Restrict /tmp/dynamic_socket so only root and the daemon can read or write it (for example, chmod 600 owned by root). This closes the unauthenticated local path while a patch is pending.
• Reduce local accounts. Remove unnecessary shell users and audit which accounts can log in to Gaia appliances directly.
• Watch for escalation. Hunt logs for local logins followed by privileged actions, and alert on unexpected changes to firewall policy or configuration.
• Treat KEV as the priority. Federal agencies and any organization tracking KEV should remediate on the mandated timeline.

For broader incident context, see breach reports and the latest security news.

Security Insight

This is a classic local privilege escalation flaw, and the lesson is that a world-writable socket on a root daemon is effectively an unauthenticated root shell for anyone with a login. What makes it notable is that Gaia sits at the perimeter of enterprise networks, so a small local misconfiguration becomes a full gateway compromise. It echoes past appliance flaws where a convenience interface, not a core protocol, became the weak link, and it argues for treating local account hygiene on security appliances as part of perimeter defense rather than an afterthought.

Further Reading

• All High Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs