CVE-2026-123039

Check Point Multiple Products

Patch now: it is being exploited

The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root.

In the news

• Múltiples vulnerabilidades en productos de Check Point · INCIBE-CERT
• PHP2Shell Exploited in Destructive Check Point Gateway Attacks · SecurityWeek