CISA Flags Critical Check Point Gaia OS Vulnerability in Known Exploited Vulnerabilities Catalog
The Cybersecurity and Infrastructure Security Agency (CISA) has recently announced the inclusion of CVE-2026-123039, a significant permission vulnerability found in Check Point’s Gaia operating system, in its Known Exploited Vulnerabilities catalog. This decision follows reports of active exploitation in the wild, highlighting the urgent need for organizations reliant on Gaia to take immediate action. Notably, the entry was added to the catalog on November 13, 2026, with a set deadline of November 16 for remediation efforts.
Check Point’s investigations into the exploitation have revealed that several customers have been compromised due to this vulnerability, which inadvertently allows attackers to escalate their privileges from a restricted access point to root execution. This is a major concern for organizations, as such an escalation can undermine the entire security framework of their systems.
At the core of this vulnerability lies the dynamic_server, a server process owned by root that facilitates Gaia’s DynamicCLI interface. This component accepts commands through a local interprocess communication endpoint titled /tmp/dynamic_socket, which has been configured with world-writable permissions (set at 0777). This lack of stringent access controls raises alarms about the level of security in place for such a critical interface.
Exploitation and Impact
The nature of the vulnerability is concerning; it exists because the dynamic_server daemon does not perform any authentication on the processes trying to connect to it. Consequently, an attacker who has already gained local access to the system can issue commands that carry the same root privileges as the daemon itself. This results in a local privilege escalation that effectively breaks down the security barrier that is supposed to separate ordinary user accounts from high-level, privileged services. Alarmingly, this exploitation does not require administrator credentials or extra victim engagement, making it even more perilous.
However, it is imperative to note that successful exploitation does require an existing local code execution capability; the defect in the socket does not permit unauthenticated remote access on its own. Attackers have adeptly chained this vulnerability with known exploits such as the PHP2Shell against Mobile Access portals, effectively utilizing command execution through DynamicCLI.
CVE identifiers CVE-2026-109618 and CVE-2026-109619 are associated with the initial entry points leading to the exploitation. Once attackers gained access to the portal, they escalated their privileges and deployed PHP webshells named zz*.tpl within the templates directory, thereby transitioning their foothold within the application into comprehensive control over the underlying security appliance itself.
Subsequent investigations have identified the TSGA backdoor operating under the name /tmp/CPconfigdaemon, which later transitioned into persistent operation as slot_CPconfigdaemon. This backdoor employed a component known as TSProxy that deployed the library /lib/libcpfwcommon.so, enabling attackers to intercept and manipulate network functions within appliance processes. Furthermore, attackers executed internal reconnaissance operations and gained unauthorized access to VMware ESXi infrastructure via SSH, leveraging their control to execute destructive tools.
These activities serve as a stark reminder of how local privilege escalation vulnerabilities can evolve from initial service compromises into long-term persistent access and lateral movement across the network. Such scenarios underscore the critical need for robust security practices, including regular updates and patches.
Affected Versions and Recommendations
The vulnerability affects various releases of Check Point’s software, including R82.20, R82.10, R82, R81.20, along with the end-of-support R81.10 and R81 releases. The deployments most at risk encompass firewalls, management and log servers, Multi-Domain systems, and the Maestro Orchestrator. However, it is noteworthy that Spark Firewalls and Smart-1 Cloud solutions have been reported as unaffected by this vulnerability.
CISA has recommended several updates as potential fixes, including R82.20 Take 14, R82.10 Take 52, R82 Take 132, and R81.20 Take 174. Administrators are urged to prioritize these supported vendor updates. It is also essential not to overlook the fact that merely restricting external management connectivity does not entirely eliminate the risk posed by locally reachable escalation paths.
In light of the ongoing threat, forensic teams should conduct thorough reviews of logs located in /var/log/dynamicCli.log for any unauthorized commands that lack the expected Clish wrapper, particularly those containing unusual return values. Identifying suspicious entries, unexpected webshells, and unauthorized persistence mechanisms are crucial for assessing the full extent of the breach.
In conclusion, organizations must remain vigilant and proactive in addressing this vulnerability. The corrective measures put forth by Check Point and CISA should be implemented immediately to safeguard against potential exploitation.