The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about a security flaw in Check Point software that is currently being exploited by attackers. The vulnerability enables local users to obtain root access on compromised devices. This flaw, identified as CVE-2026-123039, was added to CISA’s Known Exploited Vulnerabilities catalog on November 13, 2026, underscoring the urgency of the threat.
Exploitation Details of the Vulnerability
Check Point has acknowledged that the vulnerability has been exploited in attacks against several of its customers. With a CVSS score of 7.8, the flaw affects the DynamicCLI service in Gaia OS. Once exploited, it allows the execution of commands with the highest privileges on the operating system, putting firewalls and management systems at significant risk.
The root of the problem lies in the dynamic_server, a process responsible for managing extended command-line functions. It communicates through a socket located at /tmp/dynamic_socket, which on vulnerable systems, is improperly set with 0777 permissions. This configuration allows any local user to write to it, bypassing necessary access controls.
Security Implications and Previous Attacks
This service does not verify the identity of the process making a request and executes commands as root, potentially turning limited access into full system control. However, attackers must already have local code execution capabilities on the device before exploiting this flaw. This differentiates it from remote code execution vulnerabilities.
Past incidents, such as those involving PHP2Shell, have highlighted the dangers of privilege escalation flaws like this one, where attackers leverage initial access points to exploit deeper vulnerabilities. It’s crucial to note that merely closing entry points does not eliminate all potential threats.
Affected Systems and Remediation Steps
According to Check Point’s advisory, the vulnerability affects products such as Force Firewalls, Management and Log Servers, Multi-Domain management systems, and Maestro Orchestrator. Versions affected include R81 through R82.20, although Check Point Spark Firewalls and Smart-1 Cloud remain unaffected.
Fixes for the vulnerability have been issued through Jumbo Hotfix Accumulator updates. These patches begin with R82.20 Take 14, R82.10 Take 52, R82 Take 132, and R81.20 Take 174, addressing unauthorized access and logging such attempts. R81 and R81.10 versions are no longer supported.
Administrators can temporarily mitigate the risk by disabling the dynamic_server service using dbset commands, though this impacts certain DynamicCLI capabilities. The recommended approach is to apply the patches promptly. After patching, the /tmp/dynamic_socket should reflect permissions of 0660, indicating restricted access to root and the config group.
In light of previous vulnerabilities like those found in Check Point VPNs, which exposed sensitive information, this case highlights the critical need for local access management and swift action in response to confirmed exploitations. CISA’s alert emphasizes prioritizing these known vulnerabilities to safeguard systems.
