← Back to Vulnerability Reports CVE Intelligence

CVE-2026-123039

Check Point Multiple Products•HIGH · CVSS 7.8• In the wild In CISA KEV

What is CVE-2026-123039?

The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root.

CVSS7.8 CNA/ADP score via NVD 3.1

SeverityHIGH

Exploitation In the wild In CISA KEV

EPSS1% · P70

Triage statusActive Exploit

ActionPatch within 48 hours

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWECWE-732

NVD published2026-11-12

NVD last modified2026-11-13

Timeline

2026-11-12Published to the U.S. National Vulnerability Database (NVD)
2026-11-13Added to the CISA Known Exploited Vulnerabilities (KEV) catalog
2026-11-13NVD record last updated
2026-11-14First covered in a defend.network daily briefing
2026-11-16CISA federal remediation deadline (BOD 26-04)

CISA Known Exploited Vulnerability

Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability

Added to KEV2026-11-13

Federal patch deadline2026-11-16

Known ransomware useUnknown

Affected product

Check Point Multiple Products

Remediation Steps

CISA's KEV entry for this CVE (added 2026-11-13) sets a remediation deadline of 2026-11-16 for U.S. federal agencies.

References

Referenced in our briefings & reports

Vulnerability Priority Report – Week 2 of November 2026 (November 9 – 15)
Check Point zero-day exploited in wiper attacks; North Korea FaceStealer steals $400M crypto (2026-11-14)

Related vulnerabilities

CVE-2026-93616 – Check Point Multiple Products (same product)
CVE-2026-85102 – Check Point Multiple Products (same product)
CVE-2026-16232 – Check Point SmartConsole (same vendor)
CVE-2026-50751 – Check Point Security Gateway (same vendor)
CVE-2026-12957 (same weakness: CWE-732)

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.