CVE-2026-123039 exploited on Check Point products: prioritize remediation by November 16

CISA added CVE-2026-123039 to its Known Exploited Vulnerabilities (KEV) catalog after recording exploitation of a permissions flaw in multiple Check Point products. Product information and remediation guidance are available in the official Check Point guidance.

Overview and technical details

The vulnerability involves the DynamicCLI daemon on Gaia OS. When the daemon runs as root and listens on a local socket writable by all users without authenticating the connecting process, an authenticated local user can send commands through the socket and have them executed as root.

Affected systems

The listed Check Point products are firewalls and security management systems running Gaia OS. The affected and fixed versions are not identified in the record.

• Check Point Firewall
• Check Point Multi-Domain Security Management Server
• Check Point Scalable Platforms
• Check Point Security Gateway
• Check Point Security Management Server

Mechanism and impact

The described exploitation condition is an authenticated local user sending commands through the DynamicCLI socket. The confirmed impact is that commands may be executed as root; the record does not describe other impacts.

Exploitation status

CISA reports that CVE-2026-123039 is being exploited in the wild and has added it to KEV. Known Ransomware Campaign Use is listed as Unknown; this does not confirm use in a ransomware campaign.

System checks

1. Check the Check Point Gaia OS version on the device using the following command. Compare the running version with Check Point's official remediation guidance.

   Copy commands

   show version all

Remediation and mitigation

1. Prioritize remediation in accordance with CISA BOD 26-04. The KEV remediation deadline is November 16, 2026; assess Internet exposure for each asset and perform applicable forensic triage requirements.

2. Apply mitigations according to Check Point guidance and follow CISA BOD 26-04 guidance on risk-based security update prioritization, including guidance applicable to cloud services where relevant.

3. If no mitigation is available, discontinue use of the product.

Source: Check Point – CVE-2026-123039 remediation guidance.