CISA Adds Check Point Firewall Root Escalation Flaw to Known Exploited Vulnerabilities Catalog

The Cybersecurity and Infrastructure Security Agency added a Check Point privilege-escalation flaw, CVE-2026-123039, to its Known Exploited Vulnerabilities catalog on November 13, a placement that confirms active exploitation and starts a three-day remediation clock for federal and covered cloud and contractor networks that runs to a November 16 due date under Binding Operational Directive 26-04. The entry names Check Point Software Technologies (NASDAQ: CHKP, market cap near $15 billion), the listed vendor of the affected Quantum Security Gateway and Quantum Security Management appliances, and flags forensicTriage yes, meaning agencies should plan triage alongside remediation.

The vulnerability sits in the DynamicCLI daemon of the Gaia operating system that runs Check Point's Quantum firewall and security-management appliances. The daemon executes with root privileges and listens on a world-writable local socket at /tmp/dynamic_socket without authenticating the processes that connect to it, so an authenticated local user can send a command and have it executed as root. NVD classifies it as incorrect permission assignment (CWE-732) and missing authorization (CWE-862), and rates it 7.8 on the CVSS 3.1 scale, HIGH, on a local attack vector with low attack complexity, low privileges and no user interaction required. Check Point is the CNA of record, and NVD published the listing November 12; the advisory Check Point references, sk1000362, carries the remediation guidance for the affected families.

Related reading: CISA KEV Adds OpenSSH Auth Bypass and Three More Exploited Flaws, All Due Nov 12.

The affected products are the two workhorses of the Quantum line. On the Quantum Security Gateway, the flaw reaches R82.10 with Jumbo Hotfix Take 50 or below, R82.20 with Take 10 or below, R82 with Take 130 or below, and R81.20 with Take 173 or below, with the same version list applying to Quantum Security Management. That spread of Takes across four firmware branches means the patch is not a single download but a per-release decision, and every operator on an affected Take has to move deliberately rather than treat the fix as a point release.

What changed with the catalog placement is the enforcement clock. BOD 26-04, which CISA uses for vulnerabilities confirmed to be exploited, obliges federal civilian agencies and the covered cloud and contractor networks that serve them to remediate affected products within a set window, and CISA set this one at three days, landing on November 16. For a product welded into perimeter and management roles at enterprise scale, that is a short window against a root escalation on a device that sits at the network edge. The market consequence for Check Point is twofold: an urgent support and patching cycle across its installed Quantum base, and the upgrade and maintenance work that tends to follow a security-driven firmware migration, which in past cycles has flowed through to both support fees and refresh revenue.

Related reading: CISA KEV list: week adds 10 exploited CVEs, four on listed-vendor products.

The same event reads differently for the people who back the appliances. Cyber underwriters carry exposure to firewall-root-compromise claims, and a catalogued root escalation on a perimeter device gives insureds and their brokers a concrete, dated hook for claims activity and for subrogation against a named vendor, whatever the ultimate loss picture. On the demand side, managed-security-operations providers and firewalling and maintenance spend benefit from the forced-migration cycle the deadline creates, since operators on affected Takes have little choice but to move before November 16 or document an accepted risk.

Check Point shares have traded in the mid-$140s with a market capitalization near $15 billion, so the company is large enough to absorb a support spike without a material restatement, but the event is a live test of how it converts a security incident into disclosure, guidance and patch delivery. The forensicTriage flag keeps a second hook on the flaw after the deadline passes, and CISA catalog entries carry no public attribution of the exploit's origin, so the operational detail stays with the vendor and the agency rather than the open record.

Related reading: GitLab critical RCE joins CISA KEV with a Nov 1 federal patch deadline.

The next dated catalyst is the November 16 remediation deadline, after which Check Point's advisory sk1000362 and its patch releases become the reference operators and analysts watch. For investors the signal to track is not the scare but the cycle: how quickly Check Point ships fixes across the four firmware branches, whether the forced migration shows up in support or upgrade lines in its next reports, and how the insurer and managed-security side prices firewall root exposure after a catalogued event. None of that resolves by the deadline; the catalog date is the start of the measurable arc, not its end.

Related reading: CISA KEV: Week Adds Two Auth Bypasses and a WordPress RCE, SonicWall SSLVPN Newest.

This content is for informational purposes only and does not constitute financial advice. Past performance is not indicative of future results. Consult a qualified financial advisor before making investment decisions.