Attackers exploit Check Point Gaia flaw to gain root on Quantum systems

What happened

Attackers are abusing a flaw in Check Point's Gaia OS to turn a low-privileged local account into full root control. The problem sits in a background service called the DynamicCLI daemon. It runs with root privileges and accepts commands over a local socket that any user on the system can write to. It never checks who is connecting.

Anyone who already has a login on an affected machine can hand that service a command and have it carried out as root. The weakness comes down to wrong file permissions combined with a missing authorization check.

CISA added the flaw to its Known Exploited Vulnerabilities catalog on 13 November 2026.

Who is affected

The flaw affects Check Point Quantum Security Gateway and Quantum Security Management in these releases:

R81.20 with Jumbo Hotfix Take 173 or below R82 with Jumbo Hotfix Take 130 or below R82.10 with Jumbo Hotfix Take 50 or below R82.20 with Jumbo Hotfix Take 10 or below

Check Point has not yet said which Jumbo Hotfix Take fixes the issue.

How serious is it

Check Point rates the flaw 7.8 out of 10, which is high. An attacker needs a local account first, so it cannot be used directly from the network. Once inside, though, the attacker gets complete control of a device that sits at the center of network security. The flaw is under active exploitation, and US federal agencies must deal with it by 16 November 2026.

What you should do

1. 1Check whether your Quantum Security Gateway and Security Management systems run one of the affected releases and Jumbo Hotfix Takes.
2. 2Follow Check Point's support guidance for this flaw and apply the mitigations it describes.
3. 3Install a fixed Jumbo Hotfix as soon as Check Point confirms one, and watch for updates to its guidance.
4. 4If no mitigation is available for your setup, consider taking affected systems out of use, in line with CISA's instruction.

Quick facts