Check Point

CVE-2026-123039 — Check Point Gaia OS local privilege escalation to root, exploited in the wild: explainer and fix (listed in KEV, due 16 November)

A local privilege escalation in Check Point's Gaia OS (CWE-732, CWE-862). The DynamicCLI daemon runs as root and listens on a world-writable local socket without authenticating the connecting process, so an authenticated local user can have a command run as root. CVSS is 7.8 (high). Check Point confirmed exploitation against a couple of dozen customers, and CISA added it to KEV on 13 November (due 16 November). Check Point's research reports a chain in which attackers got into the Mobile Access portal (PHP2Shell) and then used this flaw to reach root. This site's view: install the Jumbo Hotfix; where you cannot yet, stop dynamic_server as the advisory describes, and check for compromise.