{"affected":[{"product":"Quantum Security Gateway","source":"CNA: checkpoint","vendor":"checkpoint","versions":[{"status":"affected","version":"R82.10 with Jumbo Hotfix Take 50 or below"},{"status":"affected","version":"R82.20 with Jumbo Hotfix Take 10 or below"},{"status":"affected","version":"R82 with Jumbo Hotfix Take 130 or below"},{"status":"affected","version":"R81.20 with Jumbo Hotfix Take 173 or below"}]},{"product":"Quantum Security Management","source":"CNA: checkpoint","vendor":"checkpoint","versions":[{"status":"affected","version":"R82.10 with Jumbo Hotfix Take 50 or below"},{"status":"affected","version":"R82.20 with Jumbo Hotfix Take 10 or below"},{"status":"affected","version":"R82 with Jumbo Hotfix Take 130 or below"},{"status":"affected","version":"R81.20 with Jumbo Hotfix Take 173 or below"}]}],"cveId":"CVE-2026-123039","cwes":["CWE-862","CWE-732"],"description":"The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.8,"severity":"high","source":"CNA: checkpoint","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794492133665,"publishedAt":1794492133665,"references":[{"source":"CNA: checkpoint","tags":[],"url":"https://support.checkpoint.com/results/sk/sk1000362"}],"remediation":[],"revision":"0f0f59890011179d6dd9ff072b1d3f9436de1f98d035e501b5cdcd1c06105bab","sources":[{"modifiedAt":1794492133665,"name":"CNA: checkpoint","retrievedAt":1794496253434,"url":"https://www.cve.org/CVERecord?id=CVE-2026-123039"}],"ssvc":null,"status":"published","title":"Local privilege escalation to root in the DynamicCLI daemon via local world-writable control socket","updatedAt":1794496253434}