CISA Adds Exploited Check Point DynamicCLI Root Escalation to KEV

Quick Answer

Apply the matching Check Point Jumbo Hotfix and investigate DynamicCLI activity. CISA lists November 16 as the due date and flags forensic triage; assess asset exposure under applicable BOD 26-04 guidance.

Last verified: 2026-11-14 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.

Scope And Authority

Product scope	Check Point Force Firewalls, Management/Log Servers, Multi-Domain Management/Log Servers and Maestro Orchestrator
Advisory	CISA-KEV-CVE-2026-123039 / sk1000362
CVE	CVE-2026-123039
Authoritative KEV addition date	2026-11-13 — CISA KEV addition; catalog released at 2026-11-13T20:24:18.3008Z.
Authority revision date	No later KEV revision is recorded. Original vendor disclosure: 2026-11-08; vendor last modified 2026-11-12.
Affected versions	Affected Gaia releases: R82.20, R82.10, R82, R81.20, R81.10 and R81. The attacker needs authenticated local code execution. Check Point Spark Firewalls and Smart-1 Cloud are not affected.
Fixed version	Jumbo Hotfix Accumulator: R82.20 Take 14; R82.10 Take 52; R82 Take 132; R81.20 Take 174, or later applicable takes.
CVSS base score	7.8 (vendor-stated CVSS score; version not specified)
CVSS severity	High
Exploitation status	Active exploitation confirmed by Check Point and CISA; CISA lists ransomware campaign use as Unknown.; no exploitation claim is inferred.

What Changed

CISA added this exploited local privilege-escalation flaw to KEV on November 13. Check Point confirms exploitation; an unauthenticated local control socket allows a local process to submit commands to a root-owned daemon.

What To Validate Now

1. Inventory. Identify affected appliances and each cluster member, Gaia release, installed Jumbo take, local access paths and accountable owner.
2. Establish applicability. Validate the vendor product and version matrix. Local code execution is required; internet exposure alone does not establish that prerequisite.
3. Remediate. Install the matching Jumbo take. If immediate patching is unavailable, follow sk1000362 to stop dynamic_server and prevent restart, after reviewing the loss of Dynamic CLI commands. R81 and R81.10 are end-of-support branches with no fixed take listed here.
4. Validate. Confirm installed takes and /tmp/dynamic_socket permissions of 0660 owned by root:config. Preserve /var/log/dynamicCli.log; investigate unexpected commands and correlate rejected-UID events with authentication and portal logs.
5. Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.

Operational Cautions

Containment can interrupt Dynamic CLI operations. Preserve evidence before changes and follow the vendor checks on every cluster member. Patching does not establish absence of compromise; BOD requirements apply to covered federal systems, while other organizations set their own obligations.

Evidence To Retain

• Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
• UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
• Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.

Related TechGeeks Resources

• TechGeeks Security Notice Center
• All Security Notices

Authoritative References

• Check Point sk1000362
• CISA Known Exploited Vulnerabilities catalog
• CISA November 13 KEV announcement
• CISA BOD 26-04
• CISA BOD 26-04 implementation guidance

Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.