Gaia OS - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/gaia-os/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 12 Nov 2026 16:51:17 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCheck Point Gaia OS: Local Privilege Escalation in DynamicCLI (CVE-2026-123039)https://feed.craftedsignal.io/briefs/2026-11-gaia-os-privesc-cve-2026-123039/Thu, 12 Nov 2026 16:51:17 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-gaia-os-privesc-cve-2026-123039/The DynamicCLI daemon in Gaia OS executes arbitrary commands as root by accepting input from a world-writable local socket without authentication, enabling local privilege escalation.Check Point Gaia OS contains a privilege escalation vulnerability (CVE-2026-123039) in the DynamicCLI daemon. The daemon runs with root privileges and exposes a world-writable local socket at /tmp/dynamic_socket. The service fails to authenticate or validate connecting processes, allowing any authenticated local user to send commands to the socket for execution with root privileges.

Impact

An attacker who has established local access to a system running an affected version of Gaia OS can escalate privileges to root, resulting in full compromise of the affected appliance.

Recommendation

  • Inventory all systems running Gaia OS to identify exposure.
  • Monitor for the existence and permissions of the /tmp/dynamic_socket file.
  • Contact Check Point support for patch availability and apply updates as directed by the vendor advisory.
]]>highadvisory