CVE-2026-123039: Check Point Gateways Rooted, ESXi Wiped

Check Point has confirmed that attackers chained CVE-2026-123039, a root privilege escalation flaw in Gaia OS, with the PHP2Shell bugs to take over unpatched Security Gateways, plant a backdoor and wipe VMware ESXi hosts.

CVE-2026-123039 is a missing-authorisation flaw in the DynamicCLI process of Gaia OS, rated CVSS 7.8. It affects R81, R81.10, R81.20, R82, R82.10 and R82.20 on Security Gateways and Force firewalls, Management and Log Servers, Multi-Domain servers and Maestro. Spark firewalls and Smart-1 Cloud are not affected by this CVE.

Check Point Research said the attacks began on October 30 against Israeli organisations, some of which suffered destructive activity. A second wave on November 2 reached organisations in multiple countries, with no sector preference and no wiper use.

Check Point’s advisory sk1000362 says exploitation was observed against “a couple of dozen customers.” CISA added CVE-2026-123039 to its Known Exploited Vulnerabilities catalog on November 13.

The attackers first used PHP2Shell , tracked as CVE-2026-109618 and CVE-2026-109619, against internet-facing Mobile Access portals, which gave them code execution as the portal service account. They then sent a single request to the DynamicCLI socket, which ran their command as root.

A proof-of-concept repository on GitHub describes the root cause of CVE-2026-123039: the dynamic_server daemon creates /tmp/dynamic_socket as world-writable and does not check who connects to it. The author says the analysis comes from a reconstructed lab model, because the Check Point binary is closed-source.

With root access, the attackers placed PHP web shells in the portal’s login page templates, then installed a backdoor called TSGA under the name slot_CPconfigdaemon. TSGA steals gateway configurations, persists through backups and snapshots, and tampers with firewall logs. Its embedded TSProxy component hides attacker connections inside normal appliance processes.

In some first-wave intrusions, the attackers scanned the internal network with the gogo scanner, moved over SSH to a VMware ESXi host using the vpxuser service account, and ran a wiper named destroy_v6. The wiper overwrites files with zeros, deletes them, and leaves a Hebrew-language note, DREAM_ANNEXATION.txt, that rejects ransom negotiations.

Check Point links TSGA and TSProxy to PhiliKit, a toolkit previously tied to the China-nexus group UNC5221, but said the evidence does not support a high-confidence attribution. The company listed an initial access broker and a false-flag operation among the possibilities.

Administrators should install the latest Jumbo Hotfix for their Gaia release, which carries the CVE-2026-123039 fix, and the PHP2Shell hotfix. According to Check Point, the attacks started a week after a security fix became available.

Where patching must wait, sk1000362 lists one mitigation: stop the dynamic_server process and prevent it from restarting. Dynamic CLI commands stop working while the mitigation is in place.

Gateways that were exposed and unpatched since October 30 should be checked for unexpected entries in /var/log/dynamicCli.log, files matching zz*.tpl in the portal templates directory, a slot_CPconfigdaemon process, and connections from 130.94.19[.]204 or 130.94.19[.]168.

Join the conversation. Ask questions, solutions, and help others.

Be the first to start the discussion!