CVE-2026-123039: Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability
Vulnerability summary
CVE-2026-123039 is a high (CVSS 7.8) Missing Authorization vulnerability in Check Point Multiple Products. It is known to be exploited: CISA lists it, first on 13-11-2026. EPSS estimates a 1.27% chance of exploitation in the next 30 days, higher than 70.3% of scored vulnerabilities.
Listed as exploited by CISA (13-11-2026)
Source freshness unavailable
How is this decided?Timeline
- 12-11-2026PublishedVulnerability first disclosed.
- 13-11-2026Added to CISA KEVExploitedCheck Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability
- 13-11-2026Last modifiedVulnerability information updated.
- 16-11-2026CISA remediation dueUpcomingApply mitigations per vendor instructions.
Description
The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.27%
Chance of exploitation in the next 30 days
Percentile
70%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 13-11-2026
- Federal due date
- 16-11-2026
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
CISA required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. support.checkpoint.com/results/sk/sk1000362 nvd.nist.gov/vuln/detail/CVE-2026-123039
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
- CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Affected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Checkpoint2 products
- quantum security gatewayR82.10 with Jumbo Hotfix Take 50 or below | R82.20 with Jumbo Hotfix Take 10 or below | R82 with Jumbo Hotfix Take 130 or below | R81.20 with Jumbo Hotfix Take 173 or below
- quantum security managementR82.10 with Jumbo Hotfix Take 50 or below | R82.20 with Jumbo Hotfix Take 10 or below | R82 with Jumbo Hotfix Take 130 or below | R81.20 with Jumbo Hotfix Take 173 or below
1 vendor · 2 products