Vulnerabilities · 21h ago
Italy’s CSIRT reports active exploitation of one privilege-escalation flaw in Check Point Gaia OS; BleepingComputer says attacks date to late October. The flaw affects Check Point firewalls, gateways, Scalable Platforms, and Security Management servers.
An attacker must already have code running locally on the appliance; this is not an internet-facing entry point. Gaia’s root-run dynamic_server service accepts commands through a local socket writable by any user and does not authenticate the sender, so a foothold can become root access. Check Point has released emergency hotfixes.
For teams running these appliances, root access reaches the control plane that governs network security. A hotfix closes the path forward but cannot establish that the device was not already elevated or left with persistence; unsupported R81.10 and R80-series releases have no vendor patch.
Published Nov 12 by Check Point Software
Known exploited · CISA KEV
CVSS 7.8 HIGH: the Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes.
CISA federal remediation date Nov 16
3 sources covering this story
Rilevate vulnerabilità in prodotti Check Point
Tra queste si evidenzia la CVE-2026-123039, per la quale è stato rilevato lo sfruttamento attivo in rete.
Check Point warns of zero-day flaw exploited for root access
Check Point Software has released emergency hotfixes to address a high-severity flaw that hackers have been exploiting to gain root privileges and establish persistence on vulnerable devices since late October.
Múltiples vulnerabilidades en productos de Check Point
Check Point ha publicado un boletín sobre 5 vulnerabilidades, 2 de severidad crítica, 2 altas y 1 baja
Part of the PlainSec briefing for 2026-11-13