Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability
Check Point — Multiple Products
- Added to KEV catalog
- 13 November 2026
- Federal remediation due date
- 16 November 2026
- Weakness classification (CWE)
- CWE-732, CWE-862
AI Breakdown
What it is
A flaw exists across multiple Check Point products running Gaia OS where a background management service runs with root privileges and listens on an insecure local socket. An authenticated user with basic local access can send unauthorized commands directly to this socket without undergoing authentication checks. As a result, the service executes those commands with full root administrative privileges.
Why it matters
This vulnerability allows attackers with existing access to achieve complete control over critical network security devices by escalating to root permissions. While specific ransomware use remains unknown, CISA has added this flaw to its catalog due to confirmed active exploitation. A compromise of these core firewalls and security gateways can severely undermine an organization's entire defensive posture.
Recommended action
Apply vendor-provided mitigations immediately in accordance with Check Point instructions and CISA risk prioritization guidance. Security teams must evaluate internet exposure, perform required forensics triage, and address cloud services appropriately. If vendor mitigations are unavailable or cannot be implemented, organizations should discontinue use of the impacted products.
AI-generated from CISA and NVD data — treat as a starting point, not a substitute for your own risk assessment.
CISA Description
Check Point Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway, and Security Management Server contain an incorrect permissions assignment for critical resources vulnerability when the Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root.
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes
https://support.checkpoint.com/results/sk/sk1000362 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-123039
NVD Technical Description
The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root.
More Check Point Vulnerabilities
Check Point Multiple Products Path Traversal Vulnerability
Check Point Multiple Products Improper Certificate Validation Vulnerability
Check Point SmartConsole Improper Authentication Vulnerability
Check Point Security Gateway Improper Authentication Vulnerability
Check Point Quantum Security Gateways Information Disclosure Vulnerability
Is this vulnerability present in your environment?
CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.
Explore VAPT Services