Vulnerability Intelligence Report
Local privilege escalation to root in the DynamicCLI daemon via local world-writable control socket
CVE-2026-123039
The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root.
CISA KEV
SSVC: Active Exploitation
CVSS Base Score
7.8
HIGH
Exploitability:1.9
Impact Score:5.9
EPSS Probability:1.27%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| checkpoint | Quantum Security Gateway | R82.10 with Jumbo Hotfix Take 50 or below (affected), R82.20 with Jumbo Hotfix Take 10 or below (affected), R82 with Jumbo Hotfix Take 130 or below (affected), R81.20 with Jumbo Hotfix Take 173 or below (affected) |
| checkpoint | Quantum Security Management | R82.10 with Jumbo Hotfix Take 50 or below (affected), R82.20 with Jumbo Hotfix Take 10 or below (affected), R82 with Jumbo Hotfix Take 130 or below (affected), R81.20 with Jumbo Hotfix Take 173 or below (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Check Point Software Ltd. · Vendor · Israel |
| Reserved | 2026-11-05T07:30:18 |
| Published | 2026-11-12T14:02:13 |
| Last Updated | 2026-11-13T19:25:14 |
Community Chatter & Buzz