CVE-2026-123039

Name of the Vulnerable Software and Affected Versions Gaia OS (affected versions not specified)

Description The DynamicCLI daemon runs as root and listens on a world-writable local socket /tmp/dynamic socket without authenticating connecting processes. This allows an authenticated local user to send commands to the socket to be executed with root privileges. This issue has been exploited in real-world attacks starting October 30, initially targeting Israeli organizations before expanding globally. Attackers chained this flaw with PHP2Shell to gain root access to Security Gateways, deploy persistent backdoors, steal configurations, and move laterally into VMware ESXi infrastructure to deploy destructive wiper malware. Approximately two dozen unpatched systems were compromised.

Recommendations Install the latest Jumbo Hotfix immediately. As a temporary mitigation, restrict access to the /tmp/dynamic socket socket to minimize the risk of local privilege escalation.