Check Point patches Gaia root flaw already used against customers

Check Point patches Gaia root flaw already used against customers

13 November 2026: Check Point has fixed CVE-2026-123039, a high-severity flaw (CVSS 7.8) in its Gaia operating system that lets anyone able to run code on a firewall or management server take over the box as root, and the company says it has seen the flaw exploited against a couple of dozen customers. CISA has added it to its Known Exploited Vulnerabilities catalogue with a due date of 16 November; the fix is in the Jumbo Hotfix Accumulator Takes listed below.

Not yet independently verified. We read the Check Point and Canadian Cyber Centre pages through text extraction, and the value that switches off the dynamic_server process did not come through, so confirm it on Check Point's own page. The first-exploitation date and the attack chain through the Mobile Access portal come from BleepingComputer, not from Check Point's article. We will update this when it can be confirmed, and remove this note.

A world-writable socket that runs commands as root

Gaia's dynamic command line is served by a root process called dynamic_server, which listens on a local socket at /tmp/dynamic_socket. On affected systems the socket is world-writable (mode 0777) and the process does not check who is connecting. Whatever command string arrives is run as root. An attacker needs only a way to run code on the appliance.

Check Point states the limit plainly: the attacker must already have local code execution. That makes the flaw a second-stage tool, the step that turns a foothold into full control. CISA lists the weakness as incorrect permission assignment for a critical resource.

Affected products are Force firewalls, Management and Log Servers, Multi-Domain Security Management and Multi-Domain Log Server, and Maestro Orchestrator. Spark firewalls and Smart-1 Cloud are not affected.

Jumbo Take numbers that close the hole

Check Point's fix makes the daemon block and log unauthenticated calls. It is delivered in these takes:

• R82.20: Jumbo Hotfix Accumulator Take 14 or later
• R82.10: Take 52 or later
• R82: Take 132 or later
• R81.20: Take 174 or later

R81.10 and R81 are listed as affected but are end of support, and the article lists no fix for them. After patching, ls -l /tmp/dynamic_socket should show mode 0660 owned by root and the config group, not 0777.

How attackers reached the appliance first

BleepingComputer, citing Check Point, reports exploitation from late October. In that account attackers first got into the Mobile Access portal using the PHP2Shell flaws, escalated to root with this one, dropped webshells and installed the TSGA backdoor and TSProxy malware, then moved from the gateway to a VMware ESXi host and deployed wiper malware. Check Point's own article gives no customer names and no first-exploitation date.

Stopping the process when a hotfix must wait

If the hotfix cannot go on yet, Check Point's workaround is to stop dynamic_server and stop it restarting, using dbset process:dynamic_server with the value set to disable it, followed by dbset :save. The cost is that the Dynamic CLI commands listed in its article sk144112 fail while the process is off. Running dbset process:dynamic_server t and saving turns it back on.

Log lines that show an attempt or a break-in

The daemon writes received commands to /var/log/dynamicCli.log. On a fixed system, a blocked attempt appears as "Rejected connection from unauthorized uid"; Check Point says an unexpected user ID, such as 99 (nobody), marks a blocked escalation attempt, and bursts should be matched against portal and authentication logs. Check Point also gives searches for commands missing the normal Clish wrapper, for the system() sink marker, and for intruder commands such as whoami, netcat, useradd or edits to authorized_keys. Any hit should be treated as possible root command execution.

A second Gaia flaw in the same bulletin

The Canadian Centre for Cyber Security's advisory AV26-1154 covers two flaws. The other is CVE-2026-107484 (CVSS 7.3), an input and authorisation validation flaw in Gaia Portal backend handlers that lets an authenticated non-administrator perform privileged operations and potentially gain full administrative control. It affects R82.10, R82 and R81.20 plus end-of-support lines back to R80, and R82.20 is not affected. The fixes are the same takes as above for R82.10, R82 and R81.20. Check Point's page does not say it is exploited, and CISA's entry covers only CVE-2026-123039. Its workaround is to limit which hosts can reach the Gaia Portal and Clish through the Host Access settings.

Sources

• Check Point: sk1000362, CVE-2026-123039 local privilege escalation to root via Dynamic CLI socket, 12 November 2026
• Check Point: sk1000291, CVE-2026-107484 Gaia Portal privilege escalation, 12 November 2026
• CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog, 13 November 2026
• Canadian Centre for Cyber Security: Check Point security advisory AV26-1154 (Update 1), 13 November 2026
• BleepingComputer: Check Point patches zero-day that lets hackers get root access, 13 November 2026