Check Point DynamicCLI Flaw Enables Local Root Escalation Across Multiple Products

Key points

• CVE-2026-123039 affects multiple Check Point products through the DynamicCLI daemon.
• A local authenticated user can reach a world-writable socket and execute commands as root.
• No process authentication and broad critical-resource permissions amplify impact.
• Apply vendor mitigations, assess exposure, and align with CISA BOD 26-04.

Check Point has assigned CVE-2026-123039 to a security weakness that lets a user who already has local access on a host elevate privileges to root. The flaw centers on the DynamicCLI daemon, which exposes a local socket writable by any user and does not verify the identity of connecting processes. Because critical resources carry overly broad permissions, an attacker who reaches that socket can run commands as root.

The vendor's advisory scope spans several products: Firewall, Security Gateway, Security Management Server, the multi-domain management server line, Scalable Platforms, and Gaia OS. The attack path is local rather than remote, so exploitation requires an authenticated account on the target. That lowers broad internet-facing risk but raises concern for shared administrative hosts, jump boxes, and multi-tenant management deployments where low-privileged users coexist with sensitive security infrastructure.

Root on a firewall or management server is a serious outcome. These systems enforce network boundaries, store policy, and broker trust between domains; a local user who becomes root can alter rules, reach secrets, or pivot into managed environments. The absence of process authentication on a world-writable socket is the kind of design weakness that turns a modest local foothold into full control of critical security gear.

Check Point directs customers to apply its mitigations and follow its instructions. Organizations should first determine which assets are exposed, then decide whether a fix is available; if no mitigation exists for a given deployment, the vendor guidance is to stop using the affected component. CISA's BOD 26-04 also sets expectations for federal response, and state and local agencies should align their handling with that directive.

Watch for updated vendor guidance, patch availability by product, and any signs of local privilege abuse on Check Point hosts. Prioritize internet-facing gateways and management servers, but do not ignore internal Scalable Platforms or Gaia OS installations. Because the vector is local, account hygiene and host monitoring matter as much as perimeter controls.

What to do now

1. Inventory every Check Point asset in scope: Firewall, Security Gateway, Security Management Server, multi-domain management server, Scalable Platforms, and Gaia OS.
2. Apply Check Point's mitigations and follow the vendor's instructions as soon as they are available for each product.
3. Evaluate which hosts are exposed to local, authenticated users; treat shared jump boxes and management servers as highest priority.
4. If no mitigation exists for a deployment, discontinue use of the affected component or isolate it until a fix is available.
5. Align incident handling and reporting with CISA BOD 26-04 requirements.
6. Audit local accounts and restrict interactive access on security infrastructure to essential administrators.
7. Monitor DynamicCLI socket permissions and watch for unexpected root-level command activity on Check Point systems.

Original source

CISA Known Exploited Vulnerabilities