> Source: [sk1000362](https://support.checkpoint.com/results/sk/sk1000362)

# sk1000362 - CVE-2026-123039 - Local privilege escalation to root in the DynamicCLI process via local world-writable control socket

| Property | Value |
|----------|-------|
| Solution ID | sk1000362 |
| Date Created | 2026-11-08 |
| Last Modified | 2026-11-12 |
| Technical Level | General |
| Products | Security Gateway, Security Management Server, Multi-Domain Security Management Server, Check Point Firewall, Scalable Platforms |
| Versions | R82.10, R82, R81.20, R81.10 (EOS), R82.20, R81 (EOS) |

## Symptoms

- <br />

* Gaia OS dynamic/extended CLI is served by a root process `dynamic_server`, which listens on a local Inter-Process Communication (IPC) socket `/tmp/dynamic_socket`. On affected products, the socket is created world-writable (`0777`) with no authentication of the connecting process, and the `dynamic_server` process executes whatever command string it receives **as root** . As a result, any authenticated local user can run arbitrary commands as root by writing a single request to the socket.  
  The issue is a local privilege escalation and requires the attacker to already have local code execution on the appliance.  
  Check Point observed an active exploit of this vulnerability against a couple of dozen customers.
* This issue received the ID [CVE-2026-123039](https://www.cve.org/CVERecord?id=CVE-2026-123039) with a CVSS score of 7.8.
* **Affected Products:**
  * Check Point Force Firewalls
  * Check Point Management and Log Servers
  * Multi-Domain Security Management and Multi-Domain Log Server
  * Maestro Orchestrator
* **Non-affected Products:**Check Point Spark Firewalls, Smart-1 Cloud
* **Affected Versions:**R82.20, R82.10, R82, R81.20, R81.10, R81

<br />

<br />

### Mitigation

Stop the `dynamic_server` process and prevent it from restarting. To do so, run:

`dbset process:dynamic_server `  
dbset :save

**Note:** Stopping the `dynamic_server` process causes the Dynamic CLI commands listed in [sk144112](https://support.checkpoint.com/results/sk/sk144112) to fail. To re-enable the `dynamic_server` process, run:

`dbset process:dynamic_server t
`  
`dbset :save`

To check whether the `dynamic_server` process is running, in Expert mode, run this command in Expert mode:

`ps auxw | grep -v grep | grep 'dynamic_server'`

Example output:

`admin 13801 0.0 0.0 37904 7808 ? Ss Nov02 0:00 /usr/bin/dynamic_server`

<br />

For more information about Dynamic CLI, refer to [sk144112 - Dynamic CLI: Enhancing Gaia Clish with new "Expert" mode commands](https://support.checkpoint.com/results/sk/sk144112)

### Indication of Compromise

The vulnerable daemon logs every command it receives to `/var/log/dynamicCli.log`. Legitimate requests use the following Clish wrapper:

`Received = #524288# . /opt/CPshared/5.0/tmp/.CPprofile.sh >> /dev/null; export SP_DISTRIBUTE=0; set -o noglob; <Gaia binary> 2>&1`

Any command that does not use this wrapper may indicate that a command was executed as `root` through the socket and requires investigation.

Run the following checks on each Check Point Force Firewall or Cluster member:

1. Check for received commands that do not use the expected Clish wrapper:  

   `grep "Received =" /var/log/dynamicCli.log \ | grep -vF "CPprofile.sh >> /dev/null; export SP_DISTRIBUTE=0; set -o noglob;"`  

2. Check for use of the `system()` sink, which is uncommon or absent in legitimate traffic:  

   `grep -F "Received = #return_value#" /var/log/dynamicCli.log`  

3. Check for commands commonly associated with exploitation attempts:  

   `grep -EI "Received =.*( id;| whoami| /etc/shadow| ncat| nc -| /dev/tcp| curl | wget | base64| useradd| authorized_keys)" \
   /var/log/dynamicCli.log`

## Solution

This problem was fixed. The fix is included in:

* [Jumbo Hotfix Accumulator for R82.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82.20/index.html) starting from Take 14
* [Jumbo Hotfix Accumulator for R82.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82.10/Default.htm) starting from Take 52
* [Jumbo Hotfix Accumulator for R82](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82/Default.htm) starting from Take 132
* [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 174

The fix blocks and logs unauthenticated calls to the Dynamic CLI command. A blocked unauthenticated call can be identified in the log using the following command:

`grep "Rejected connection from unauthorized uid" /var/log/dynamicCli.log`

Example output:

```
[DynamicCLI]: Rejected connection from unauthorized uid 99 (pid 123456)
```

<br />

* A non-zero or unexpected UID (for example, 99 = nobody) in these lines indicates that an escalation attempt occurred and was blocked
* Confirm the box is actually fixed. The output of the` ls -l /tmp/dynamic_socket` command should show `srw-rw---- root config (0660)`, not `srwxrwxrwx (0777)`.
* As described above, correlate any bursts of rejected connections with portal/web and authentication logs to identify the source.

<br />

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content