CVE Alert: CVE-2026-123039 – checkpoint

The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root.

**Risk verdict:** Urgent remediation is warranted because exploitation is marked active, although the supplied data does not confirm KEV listing or provide an EPSS score.

**Why this matters:** Successful exploitation can give an attacker complete control of the affected security appliance, enabling disruption, configuration changes or access to sensitive traffic and credentials. This is a local escalation, so an attacker first needs a foothold; it is not evidence of unauthenticated remote compromise.

**Most likely attack path:** The path requires local access and low privileges, but has low complexity and needs no further user action. The impact remains within the appliance’s security scope, though control of a gateway or management system could support subsequent attacks on connected environments.

**Who is most exposed:** Organisations running these gateway or central-management appliances, especially where multiple administrators or services can obtain local access, face the greatest exposure. The supplied data does not establish which deployments are internet-reachable.

Audit access to `/tmp/dynamic_socket`, including process identity and parent process.

Alert on unexpected root processes or commands launched by the DynamicCLI daemon.

Review local logins, new accounts and privilege changes preceding suspicious activity.

Check for unexplained appliance configuration changes or service interruptions.

Mitigation and prioritisation

Apply the vendor’s corrected Jumbo Hotfix as soon as operationally feasible; confirm the exact applicable fix with vendor guidance.

Restrict local access to trusted administrators and reduce unnecessary accounts and services.

If patching is delayed, assess isolation or access restrictions as temporary controls; validate these do not disrupt management.

Plan a controlled change with configuration backup and post-update service and access checks.

Confirm KEV status and obtain EPSS data; neither is explicitly supplied here.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.