CISA adds exploited Check Point Gaia root flaw to KEV with a 16 November federal deadline
Owners of Gaia-based gateways must treat this as a possible compromise, not a routine patch, because the KEV entry requires forensic triage and a three-day federal deadline. Perimeter firewalls and management servers are the most trusted systems in a network, so root access on them undermines everything behind them. Security teams outside the US federal sphere should adopt the same triage standard, starting with accounts that can reach the local socket.
What Happened
On 13 November CISA added two flaws to its Known Exploited Vulnerabilities catalog: CVE-2026-123039 in Check Point Gaia OS and CVE-2026-114713 in UnrealIRCd. The Check Point flaw arises because the Gaia DynamicCLI daemon runs as root and listens on a world-writable local socket without authenticating callers, so an authenticated local user can run commands as root. The KEV entry sets a due date of 2026-11-16 and requires forensic triage under BOD 26-04; the Canadian Centre for Cyber Security notes Check Point says the flaw is exploited in the wild.
Why It Matters
Owners of Gaia-based gateways must treat this as a possible compromise, not a routine patch, because the KEV entry requires forensic triage and a three-day federal deadline. Perimeter firewalls and management servers are the most trusted systems in a network, so root access on them undermines everything behind them. Security teams outside the US federal sphere should adopt the same triage standard, starting with accounts that can reach the local socket.
Sources
- CISA (opens in a new tab): CISA Adds Two Known Exploited Vulnerabilities to Catalog (2026-11-13)
- CISA (opens in a new tab): Known Exploited Vulnerabilities Catalog (2026-11-13)
- Canadian Centre for Cyber Security (opens in a new tab): Check Point security advisory (AV26-1154) (2026-11-13)
More From This Briefing
- Bermuda Government warned of email disruption as Microsoft traces global 365 outage to fault from earlier network capacity upgrade
- AI Futures Project pulls Superhuman AI Researcher forecast into May to November 2027
- PwC Bermuda summit in Hamilton: re/insurance CEOs weigh AI and data-centre systemic risk
- OpenAI launches ChatGPT Wallet so its agents can buy for users, built with Visa, Mastercard, Amex
More on Defense
- Jensen Huang resigns from Nvidia; CFO Colette Kress named interim CEO as board probe continues (13 November 2026)
- Warren and Banks urge Commerce to close chip loopholes; Epoch estimates 1.6m H100-equivalents reached China (12 November 2026)
- Microsoft's November Patch Tuesday fixes an exploited Outlook zero-day that steals NTLM hashes (11 November 2026)
- Critical Xen Orchestra authentication bypass is being exploited to take over XCP-ng hosts (11 November 2026)
Key Terms
- Known Exploited Vulnerabilities (KEV) catalog: The Known Exploited Vulnerabilities catalog is a list maintained by the US Cybersecurity and Infrastructure Security Agency (CISA) of...
- CVE: A CVE (Common Vulnerabilities and Exposures) identifier is a unique public reference, such as CVE-2026-12345, assigned to a specific...
Filed under Defense and National Security, Cybersecurity and AI Threats, Government and National Security, CISA, Check Point.
This story is part of the Laurenceo Intelligence briefing for 14 November 2026, a daily sourced briefing on AI, technology and enterprise risk published in Bermuda by Laurenceo, founded by Jorai Laurenceo. It is produced by an automated research pipeline and checked before publication; how this is made. General information only, not legal, regulatory or financial advice.