CVE-2026-123039
Local privilege escalation to root in the DynamicCLI daemon via local world-writable control socket
CVSS Score
7.8
EPSS Score
0.0%
EPSS Percentile
0th
The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root.
| CWE | CWE-862 CWE-732 |
| Vendor | checkpoint |
| Product | quantum security gateway |
| Published | Nov 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for checkpoint quantum security gateway
Be the first to know when new high vulnerabilities affecting checkpoint quantum security gateway are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
checkpoint / Quantum Security Gateway
R82.10 with Jumbo Hotfix Take 50 or below R82.20 with Jumbo Hotfix Take 10 or below R82 with Jumbo Hotfix Take 130 or below R81.20 with Jumbo Hotfix Take 173 or below
checkpoint / Quantum Security Management
R82.10 with Jumbo Hotfix Take 50 or below R82.20 with Jumbo Hotfix Take 10 or below R82 with Jumbo Hotfix Take 130 or below R81.20 with Jumbo Hotfix Take 173 or below