# Check Point DynamicCLI: exploited local flaw grants root access Canonical: https://www.oktsec.com/radar/checkpoint-dynamiccli-cve-2026-123039 Publisher: Oktsec Language: en Published: 2026-11-13T01:26:23Z Updated: 2026-11-13T01:26:23Z Record reviewed: 2026-11-13T01:26:23Z Latest evidence check: 2026-11-13T01:26:23Z Disclosed: 2026-11-08 Check Point confirms active exploitation of a local DynamicCLI flaw. Attackers must already be able to execute code on an affected appliance before using it to gain root privileges. ## Evidence and response priority - Category: Vulnerability - Oktsec priority: Act now - Rationale: Check Point confirms active exploitation. The flaw requires existing local code execution and does not itself provide an unauthenticated remote entry point. - Evidence: Attacks confirmed - Verification: Vendor confirmed - Fix status: Additional action required - Exposure requirement: Account access required - Vendor: Check Point - Products: Gaia DynamicCLI - CVEs: CVE-2026-123039 ## Technical overview Check Point’s November 12 revision confirms active exploitation of CVE-2026-123039. The root DynamicCLI daemon accepts commands through a local socket that is writable by other users and does not authenticate the connecting process. Existing local code execution is a prerequisite. The correction authenticates callers and restricts socket permissions. The vendor provides different Jumbo Hotfix takes for four supported branches; an appliance on an older unsupported branch needs a supported upgrade path. Spark Firewalls and Smart-1 Cloud are outside the stated scope of this CVE. Check Point also provides log checks for unexpected commands. Rejected calls after the fix can indicate blocked escalation attempts; they do not by themselves establish successful compromise. Oktsec recommends reviewing earlier activity as well as verifying the installed correction. ## Recommended response Install the corrected Jumbo Hotfix for your Gaia branch and verify the socket permissions. Review DynamicCLI and authentication logs for earlier abuse; patching does not remove an existing compromise. Relevant to: Teams operating affected Check Point firewalls, management or log servers, and Maestro Orchestrator. ## CVE attribution - CVE-2026-123039: Check Point — Gaia DynamicCLI. [Source](https://support.checkpoint.com/results/sk/sk1000362) ## Affected systems and fixes ### Gaia R82.20 on affected appliances Affected: Vulnerable DynamicCLI configuration; install the branch correction Fixed release / action: Jumbo Hotfix Take 14 ### Gaia R82.10 on affected appliances Affected: Vulnerable DynamicCLI configuration; install the branch correction Fixed release / action: Jumbo Hotfix Take 52 ### Gaia R82 on affected appliances Affected: Vulnerable DynamicCLI configuration; install the branch correction Fixed release / action: Jumbo Hotfix Take 132 ### Gaia R81.20 on affected appliances Affected: Vulnerable DynamicCLI configuration; install the branch correction Fixed release / action: Jumbo Hotfix Take 174 ### Gaia R81 and R81.10 Affected: Affected branches listed as end of support Fixed release / action: Move to a supported branch with the correction; no fix listed for these branches Confirm the running version against the vendor advisory, including any distribution backports. ## CISA KEV evidence Catalog: 2026.11.10 Checked: 2026-11-13T02:21:36.147Z No matching CVE appears in the reviewed catalog snapshot. CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America. ## Supporting evidence Snapshot checked: 2026-11-13T02:21:36.567Z. These dates do not change the incident’s editorial review date. ### FIRST EPSS forecast No score returned for: CVE-2026-123039 EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-11-13T02:21:36.567Z. ## Response checklist 1. **Identify affected Gaia appliances** — Check Point lists Force Firewalls, Management and Log Servers, Multi-Domain Security Management and Log Servers, and Maestro Orchestrator. Spark Firewalls and Smart-1 Cloud are excluded from this CVE. R81 and R81.10 are out of support. 2. **Install the hotfix for the installed branch** — Use R82.20 Take 14, R82.10 Take 52, R82 Take 132 or R81.20 Take 174, or a later take containing the correction. Follow vendor instructions for every relevant appliance and cluster member. 3. **Use the vendor mitigation if patching must wait** — Check Point documents stopping dynamic_server and preventing its restart. This disables the Dynamic CLI commands described in its guidance; assess the operational impact before applying the mitigation. 4. **Verify permissions and investigate earlier activity** — The vendor expects /tmp/dynamic_socket to be owned by root:config with mode 0660, not 0777. Inspect /var/log/dynamicCli.log for commands outside the expected Clish wrapper and correlate with portal and authentication logs. Oktsec recommends incident response if suspicious execution is found. ## Relevance to AI environments Oktsec recommends reviewing shell access held by automation on affected appliances, since existing local execution can become root access. ## Sources - [DynamicCLI local privilege escalation: scope, mitigation and hotfixes](https://support.checkpoint.com/results/sk/sk1000362) — Check Point; Vendor notice; checked 2026-11-13T01:26:23Z ## Editorial record - 2026-11-13T01:26:23Z: Added verified product scope, exploitation evidence and the vendor’s correction guidance. ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/checkpoint-dynamiccli-cve-2026-123039) · [Build a response plan](https://www.oktsec.com/radar/checkpoint-dynamiccli-cve-2026-123039#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=checkpoint-dynamiccli-cve-2026-123039&service=exposure_check) - [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=checkpoint-dynamiccli-cve-2026-123039&service=patch_verification) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.