CVE Details

CVE-2026-123039 Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability
Published: 2026-11-13 CVSS: 7.8 HIGH Product: Check Point Multiple Products Due Date: 2026-11-16

Check Point Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway, and Security Management Server contain an incorrect permissions assignment for critical resources vulnerability when the Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root.

GitHub PoC

Warning: GitHub PoC repositories are unverified. Some may be fake or contain malware. Use caution and review code before running anything.
  • zulloper/cve-poc • ⭐ 26 • 2025-06-08 • Conf: 70.0%
  • CVE POC repo 자동 수집기
  • googlesky/CVE-2026-123039 • ⭐ 2 • 2026-11-13 • Conf: 99.0%
  • Containerised PoC for CVE-2026-123039: the Check Point Gaia OS Dynamic CLI daemon publishes /tmp/dynamic_socket world-writable and authenticates no caller, so any local user escalates to root. Differential lab (affected vs patched), 4-mode PoC, 0day sweep.
  • googlesky/googlesky • ⭐ 0 • 2026-10-31 • Conf: 95.0%
  • Freedom Windss — DevOps/SRE, Security Researcher, and open-source builder.

FIRST EPSS

EPSS estimates the probability of exploitation in the next 30 days. Higher values indicate higher likelihood of real-world exploitation.

No EPSS data.

Timeline

CVE Stalker KEV MITRE GitHub FIRST (EPSS)

MITRE

CVSS

  • Score: 7.8
  • Severity: HIGH
  • Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

  • Exploitation: active
  • Automatable: no
  • Technical Impact: total

References

Show Raw Data
Key Remaining Key Value
dataType CVE_RECORD
dataVersion 5.2
cveMetadata > cveId CVE-2026-123039
cveMetadata > assignerOrgId 897c38be-0345-43cd-b6cf-fe179e0c4f45
cveMetadata > state PUBLISHED
cveMetadata > assignerShortName checkpoint
cveMetadata > dateReserved 2026-11-05T07:30:18.138Z
cveMetadata > datePublished 2026-11-12T14:02:13.665Z
cveMetadata > dateUpdated 2026-11-13T19:25:14.608Z
containers > cna > affected > 0 > product Quantum Security Gateway
containers > cna > affected > 0 > vendor checkpoint
containers > cna > affected > 0 > versions > 0 > status affected
containers > cna > affected > 0 > versions > 0 > version R82.10 with Jumbo Hotfix Take 50 or below
containers > cna > affected > 0 > versions > 1 > status affected
containers > cna > affected > 0 > versions > 1 > version R82.20 with Jumbo Hotfix Take 10 or below
containers > cna > affected > 0 > versions > 2 > status affected
containers > cna > affected > 0 > versions > 2 > version R82 with Jumbo Hotfix Take 130 or below
containers > cna > affected > 0 > versions > 3 > status affected
containers > cna > affected > 0 > versions > 3 > version R81.20 with Jumbo Hotfix Take 173 or below
containers > cna > affected > 1 > product Quantum Security Management
containers > cna > affected > 1 > vendor checkpoint
containers > cna > affected > 1 > versions > 0 > status affected
containers > cna > affected > 1 > versions > 0 > version R82.10 with Jumbo Hotfix Take 50 or below
containers > cna > affected > 1 > versions > 1 > status affected
containers > cna > affected > 1 > versions > 1 > version R82.20 with Jumbo Hotfix Take 10 or below
containers > cna > affected > 1 > versions > 2 > status affected
containers > cna > affected > 1 > versions > 2 > version R82 with Jumbo Hotfix Take 130 or below
containers > cna > affected > 1 > versions > 3 > status affected
containers > cna > affected > 1 > versions > 3 > version R81.20 with Jumbo Hotfix Take 173 or below
containers > cna > title Local privilege escalation to root in the DynamicCLI daemon via local world-writable control socket
containers > cna > descriptions > 0 > lang en
containers > cna > descriptions > 0 > value The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root.
containers > cna > problemTypes > 0 > descriptions > 0 > cweId CWE-862
containers > cna > problemTypes > 0 > descriptions > 0 > description CWE-862: Missing Authorization.
containers > cna > problemTypes > 0 > descriptions > 0 > lang en
containers > cna > problemTypes > 0 > descriptions > 0 > type CWE
containers > cna > problemTypes > 0 > descriptions > 1 > cweId CWE-732
containers > cna > problemTypes > 0 > descriptions > 1 > description CWE-732: Incorrect Permission Assignment for Critical Resource.
containers > cna > problemTypes > 0 > descriptions > 1 > lang en
containers > cna > problemTypes > 0 > descriptions > 1 > type CWE
containers > cna > providerMetadata > orgId 897c38be-0345-43cd-b6cf-fe179e0c4f45
containers > cna > providerMetadata > shortName checkpoint
containers > cna > providerMetadata > dateUpdated 2026-11-12T14:02:13.665Z
containers > cna > references > 0 > url https://support.checkpoint.com/results/sk/sk1000362
containers > cna > metrics > 0 > format CVSS
containers > cna > metrics > 0 > scenarios > 0 > lang en
containers > cna > metrics > 0 > scenarios > 0 > value GENERAL
containers > cna > metrics > 0 > cvssV3_1 > version 3.1
containers > cna > metrics > 0 > cvssV3_1 > attackVector LOCAL
containers > cna > metrics > 0 > cvssV3_1 > attackComplexity LOW
containers > cna > metrics > 0 > cvssV3_1 > privilegesRequired LOW
containers > cna > metrics > 0 > cvssV3_1 > userInteraction NONE
containers > cna > metrics > 0 > cvssV3_1 > scope UNCHANGED
containers > cna > metrics > 0 > cvssV3_1 > confidentialityImpact HIGH
containers > cna > metrics > 0 > cvssV3_1 > integrityImpact HIGH
containers > cna > metrics > 0 > cvssV3_1 > availabilityImpact HIGH
containers > cna > metrics > 0 > cvssV3_1 > baseScore 7.8
containers > cna > metrics > 0 > cvssV3_1 > baseSeverity HIGH
containers > cna > metrics > 0 > cvssV3_1 > vectorString CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
containers > cna > x_generator > engine cvelib 1.8.0
containers > adp > 0 > metrics > 0 > other > type ssvc
containers > adp > 0 > metrics > 0 > other > content > id CVE-2026-123039
containers > adp > 0 > metrics > 0 > other > content > role CISA Coordinator
containers > adp > 0 > metrics > 0 > other > content > options > 0 > Exploitation active
containers > adp > 0 > metrics > 0 > other > content > options > 1 > Automatable no
containers > adp > 0 > metrics > 0 > other > content > options > 2 > Technical Impact total
containers > adp > 0 > metrics > 0 > other > content > version 2.0.3
containers > adp > 0 > metrics > 0 > other > content > timestamp 2026-11-13T19:16:35.345993Z
containers > adp > 0 > references > 0 > url https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-123039
containers > adp > 0 > references > 0 > tags > 0 government-resource
containers > adp > 0 > title CISA ADP Vulnrichment
containers > adp > 0 > providerMetadata > orgId 134c704f-9b21-4f2e-91b3-4a467353bcc0
containers > adp > 0 > providerMetadata > shortName CISA-ADP
containers > adp > 0 > providerMetadata > dateUpdated 2026-11-13T19:25:14.608Z