CISA has warned that attackers are exploiting a Check Point security flaw that lets a local user gain root access on affected appliances. The agency added CVE-2026-123039 to its Known Exploited Vulnerabilities catalog on November 13, 2026, confirming that the vulnerability is being used in real attacks.
Check Point said it observed exploitation against “a couple of dozen customers.” The flaw carries a CVSS score of 7.8 and affects the DynamicCLI service in Gaia OS. Successful exploitation allows commands to run with the highest operating system rights, putting affected firewalls and management systems at risk.
Check Point Root Access Vulnerability
The weakness sits in dynamic_server, a process that runs as root and handles extended command-line functions. It receives requests through /tmp/dynamic_socket, a local communication socket. On vulnerable systems, this socket has permissions set to 0777, allowing any local user to write to it without proper access restrictions.
The service also fails to authenticate the process sending a request. It executes the received command as root, turning limited local access into full system control. However, this is not a standalone remote code execution flaw. An attacker must already have local code execution on the appliance before exploiting it.
Cybersecurity News previously covered Check Point firewall attacks involving PHP2Shell, where attackers used this privilege escalation flaw after gaining initial access. That distinction matters because fixing an entry point alone does not remove every weakness attackers could use after reaching a device or gaining a service account.
Affected Products and Available Fixes
According to Check Point’s security advisory, affected products include Force Firewalls, Management and Log Servers, Multi-Domain management and logging systems, and Maestro Orchestrator. Vulnerable releases span R81, R81.10, R81.20, R82, R82.10, and R82.20. Check Point Spark Firewalls and Smart-1 Cloud are not affected by this flaw.
Check Point has released fixes in Jumbo Hotfix Accumulator updates. Protected releases start at R82.20 Take 14, R82.10 Take 52, R82 Take 132, and R81.20 Take 174. The correction blocks and logs unauthorized DynamicCLI requests. R81 and R81.10 are listed as end-of-support versions in the advisory.
For temporary mitigation, administrators can stop the service and prevent its restart by running dbset process:dynamic_server, followed by dbset :save. Check Point warns that this disables the Dynamic CLI commands described in its documentation. Administrators should account for that operational impact rather than treating the workaround as a permanent replacement for patching.
The daemon records received commands in /var/log/dynamicCli.log. Requests that lack the expected Clish wrapper need investigation. Check Point also recommends checking for unusual commands involving account creation, SSH keys, downloads, or sensitive files. After patching, /tmp/dynamic_socket should show permissions of 0660, owned by root and the config group, rather than 0777.
Earlier Check Point VPN zero-day coverage showed how gateway flaws can expose sensitive information. This case requires local access, but confirmed exploitation makes patching and compromise checks urgent. CISA’s alert urges organizations to prioritize known exploited vulnerabilities.
Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.
