The U.S. Cybersecurity and Infrastructure Security Agency has confirmed that a privilege-escalation flaw in Check Point’s Gaia operating system is being actively exploited, adding CVE-2026-123039 to its Known Exploited Vulnerabilities catalog on November 13, 2026. Check Point itself has acknowledged exploitation against roughly two dozen customers, making this one of the more pressing patch priorities for firewall administrators this week.

How the Flaw Works

The root cause sits in a process called dynamic_server, which runs with full root privileges and handles Check Point’s extended Dynamic CLI commands. That process listens for instructions through a local communication socket at /tmp/dynamic_socket. On vulnerable systems, the socket’s permissions are set to a wide-open 0777, meaning any local user on the box can write to it without restriction.

Compounding the problem, dynamic_server does not verify who or what is sending it commands. Whatever arrives on that socket gets executed as root. In practice, that converts a comparatively minor local foothold into complete control of the appliance.

It’s worth being precise about what this flaw is not: it is not a remote, unauthenticated path into a Check Point device on its own. An attacker still needs some form of existing local code execution — for instance, through a compromised service account or a separate initial-access bug — before this privilege-escalation issue becomes useful. Researchers have previously documented Check Point firewall intrusions that chained an initial-access technique dubbed PHP2Shell with exactly this kind of follow-on privilege escalation, which is why security teams are being told to treat the two problems as linked rather than independent.

Scope, Severity and Fixes

The vulnerability carries a CVSS score of 7.8. Check Point’s advisory lists the affected product lines as:

• Quantum/Force security gateways
• Security Management and Log Servers
• Multi-Domain management and logging deployments
• Maestro Orchestrators

Affected software spans the R81, R81.10, R81.20, R82, R82.10, and R82.20 release lines. Check Point Spark appliances and the Smart-1 Cloud service are not impacted.

Fixed builds are shipping through Check Point’s Jumbo Hotfix Accumulator updates, starting at R82.20 Take 14, R82.10 Take 52, R82 Take 132, and R81.20 Take 174. The patch closes the hole by rejecting and logging any unauthorized request sent to the Dynamic CLI service. Notably, the R81 and R81.10 branches are already listed as end-of-support in Check Point’s own advisory, so organizations still running them have no patched path forward short of an upgrade.

For teams that can’t patch immediately, Check Point has published a temporary mitigation: running dbset process:dynamic_server followed by dbset :save stops the vulnerable service and keeps it from restarting. The tradeoff is that this also disables all Dynamic CLI functionality on the device, so it should be treated as a stopgap rather than a long-term substitute for patching.

Checking for Signs of Compromise

Because CISA and Check Point have both confirmed active exploitation, organizations running any of the affected branches should assume they may already be a target and not just a hypothetical one. Check Point points administrators toward a few concrete checks:

• Review /var/log/dynamicCli.log for commands that arrived without the expected Clish wrapper — a strong sign of direct, unauthorized socket access.
• Look specifically for suspicious command activity involving new account creation, added SSH keys, file downloads, or access to sensitive configuration files.
• After applying the patch, confirm that /tmp/dynamic_socket now shows restrictive 0660 permissions owned by root and the configuration group, rather than the original 0777.

This isn’t the first time a Check Point gateway issue has drawn scrutiny this year; an earlier VPN-related zero-day exposed sensitive session information before it was fixed. The common thread across these incidents is that perimeter security appliances — precisely the devices meant to keep attackers out — have become attractive targets in their own right, and local privilege-escalation bugs inside them can be just as damaging as a remote exploit once an attacker has any kind of toehold.

CISA’s binding operating directive for federal agencies requires known exploited vulnerabilities to be remediated on a set timeline, and the agency’s alert explicitly urges all organizations — not just government ones — to prioritize this class of confirmed, in-the-wild vulnerability over theoretical risk. Given that exploitation is already underway, security teams should move the Check Point patch to the top of this week’s queue, verify their current Dynamic CLI socket permissions, and work through the log-review steps above regardless of whether they’ve seen anything unusual yet.