Check Point Gaia OS: Local Privilege Escalation in DynamicCLI (CVE-2026-123039)
The DynamicCLI daemon in Gaia OS executes arbitrary commands as root by accepting input from a world-writable local socket without authentication, enabling local privilege escalation.
CVE search metadata
CVE search record: CVE-2026-123039. Severity: high. CVSS: 7.8. KEV: no. Product: Gaia OS. Brief: Check Point Gaia OS: Local Privilege Escalation in DynamicCLI (CVE-2026-123039). Brief link: https://feed.craftedsignal.io/briefs/2026-11-gaia-os-privesc-cve-2026-123039/
Triage facts
Revision 1- Applicability
- Gaia OS
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 16:51 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Very likely
Check Point Gaia OS contains a privilege escalation vulnerability (CVE-2026-123039) in the DynamicCLI daemon. The daemon runs with root privileges and exposes a world-writable local socket at /tmp/dynamic_socket. The service fails to authenticate or validate connecting processes, allowing any authenticated local user to send commands to the socket for execution with root privileges.
Impact
An attacker who has established local access to a system running an affected version of Gaia OS can escalate privileges to root, resulting in full compromise of the affected appliance.
Recommendation
- Inventory all systems running Gaia OS to identify exposure.
- Monitor for the existence and permissions of the /tmp/dynamic_socket file.
- Contact Check Point support for patch availability and apply updates as directed by the vendor advisory.
Immediate actions
Audit Gaia OS systems to determine if they are exposed to unprivileged local users
Threat Hunt
Monitor for unauthorized write access or interactions with /tmp/dynamic_socket by non-root users.
Data: Auditd logs, Filesystem monitoring logs