CSIRT Panama warns about a flaw in checkpoint Quantum Security Gateway
KROMSE explanation
Check Point Multiple Products has a security flaw (CVE-2026-123039, CVSS 7.8). The official record says: The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root.
Yes. It is on CISA's official list of flaws attackers are using now.
Anyone running Check Point Multiple Products.
- Do it today: this flaw is being used in attacks.
- Install the maker's update for Check Point Multiple Products as soon as it is out.
- Not sure if you use it? KROMSE can check your product for free.
