External risk intelligence

Check Point Gaia DynamicCLI Root Privilege Escalation

CVE advisoryKnown Exploit

CVE-2026-123039

The vulnerability involves a local Unix domain socket (/tmp/dynamic_socket) that is only accessible to users already authenticated on the local system. It is not exposed to the public internet or network interfaces, and requires prior local access to exploit.

Check Point Multiple Products

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the Gaia OS DynamicCLI daemon, which runs with root privileges and listens on an unprotected local socket. This could allow an authenticated local user to execute commands as root on affected systems. The main concern is confirming the relevance and exposure of this vulnerability to our environment.

Local users can elevate privileges on systems.
Understand potential for internal system compromise.
Confirm if our systems are exposed internally.

Attack Path

How an attacker could exploit the issue

An attacker with local access to a system can send commands to a listening socket that are then executed with root privileges. This is possible because the DynamicCLI daemon, which runs as root, listens on a socket in a world-writable directory without verifying the identity of processes attempting to connect.

Authenticated local user access required.
Send commands to a world-writable socket.
Root privileges can be gained.

Live Threat

Current exploitation, exposure, and threat context

An authenticated local user could leverage the DynamicCLI daemon, which runs with root privileges, to execute arbitrary commands on the system. This could impact the integrity and availability of the operating system and any services running on it.

System commands could be executed as root.
An authenticated local user could send commands.
Compromise of system integrity and availability.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given that this vulnerability requires local authentication to exploit, the primary responsibility for managing this risk likely falls to the system administration or infrastructure teams managing the affected Check Point devices. The first practical step is to identify all instances of the affected technology, confirm their operational criticality and network exposure, and then assign ownership for remediation planning.

System administration teams own the issue.
Verify device reachability and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Gaia OS DynamicCLI daemon?

The DynamicCLI daemon is a background component within the Check Point Gaia operating system. It handles command-line interface operations for Check Point firewalls, security gateways, and management servers. Because it operates with root-level system permissions, it is a core process responsible for executing administrative tasks on the appliance.

What kind of security weakness is CVE-2026-123039?

This vulnerability involves incorrect permission assignment (CWE-732) and missing authorization (CWE-862). Essentially, the software creates a communication channel—a local socket—that lacks access controls. Because it does not verify who is sending commands, the system fails to prevent unauthorized users from issuing requests that the daemon then carries out with full root authority.

How does an attacker trigger this vulnerability?

An attacker triggers this by interacting with the /tmp/dynamic_socket file directly. Crucially, this requires the attacker to already have a local user account on the affected system. It is not triggered by remote network traffic, web requests, or unauthenticated users attempting to connect from another machine.

Is my system at risk if it is not on the internet?

According to Halo Surface Signal, this vulnerability is considered internal and is very unlikely to be exploited remotely. Since it requires local access to the system, network-level defenses do not directly mitigate the core issue; however, securing local access to the device remains critical to preventing the necessary preconditions.

What is the first step to address this issue?

Begin by identifying all internal systems running the affected Check Point Gaia software. Once the inventory is complete, confirm the operational role of these devices and consult official vendor support documentation to review available patches or configuration changes designed to restrict socket access and secure the daemon.

References

support.checkpoint.com/results/sk/sk1000362

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.