CVE-2026-123039 KEV
7.8
HIGH · CVSS 3.1 · EPSS 1.3% (pctl 70)
Patch first
On CISA KEV — known exploited in the wild, due 2026-11-16.
Description
The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root.
Scoring
| CVSS | 7.8 (HIGH, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 1.27% — more likely to be exploited than 70% of all CVEs |
| Weakness | CWE-732 |
| On CISA KEV | yes — remediate by 2026-11-16 |
| Public exploit | none known |
| Published | 2026-11-12 |
| Last modified | 2026-11-13 |
CISA KEV
| Name | Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability |
|---|---|
| Added | 2026-11-13 |
| Due | 2026-11-16 |
| Vendor / product | Check Point / Multiple Products |
| Ransomware use | none reported |
→ the Explorer · watch your stack · NVD