CISA adds Check Point firewall flaw allowing local users root access to KEV

CISA added CVE-2026-123039 to its Known Exploited Vulnerabilities (KEV) catalogue on 13 November 2026. The vulnerability affects Check Point Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway and Security Management Server products. Known as the Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability, it can allow an authenticated local user to run commands as root.

The flaw is an incorrect permissions assignment in the Gaia OS DynamicCLI daemon. The daemon runs as root and listens on a world-writable local socket without authenticating processes that connect to it. An authenticated local user can send a command to the socket, which the daemon executes with root privileges. The vulnerability has a CVSS score of 7.8, rated HIGH. Patch status is unknown, and no patch or advisory URL was provided in the available data.

CISA’s KEV listing means active exploitation has been confirmed. Whether the vulnerability is used in ransomware campaigns is unknown. CISA’s remediation deadline is 16 November 2026.

CISA requires organisations to apply mitigations in accordance with Check Point’s vendor instructions and ensure compliance with BOD 26-04 guidance on prioritising security updates based on risk and CISA’s Forensics Triage Requirements. For cloud services, organisations should follow applicable BOD 26-04 guidance or discontinue use of the product if mitigations are unavailable. Stakeholders must assess each asset’s internet exposure and follow BOD 26-04 patching guidelines.

Federal Civilian Executive Branch (FCEB) agencies are directly subject to the applicable CISA requirements; all organisations should review their exposure and consult the vendor’s instructions.

For full details, see the [NVD entry](https://nvd.nist[.]gov/vuln/detail/CVE-2026-123039) and [CISA KEV catalogue](https://www.cisa[.]gov/known-exploited-vulnerabilities-catalog).