CVE-2026-123039

CVE

Threat entity extracted from intelligence sources

Frequency

occurrences

First Seen

November 12, 2026

Last Seen

November 14, 2026

API

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Chinese Hackers Exploit Stolen LLM API Keys for Credential Theft via ARTEX77.0

Chinese-nexus threat actors utilized ARTEX, an open-source penetration-testing framework, to exploit stolen large language model API keys for credential theft. Amazon Threat Intelligence reported that these operations were detected between October 3 and November 5, 2026, through their MadPot decoy n...

Attackers Exploit Check Point Vulnerabilities to Deploy Wiper Malware72.8

Beginning on October 30, 2026, attackers exploited unpatched vulnerabilities in Check Point Security Gateways, specifically the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) and a local privilege escalation vulnerability (CVE-2026-123039). The initial wave targeted Israeli organizations, lea...

Check Point CVE-2026-123039 Exploited for Local Root Access69.0

Check Point Software has issued emergency hotfixes for CVE-2026-123039, a high-severity local privilege escalation vulnerability affecting Gaia OS. The flaw allows authenticated local users to execute arbitrary commands as root via a world-writable socket (/tmp/dynamic_socket) used by the DynamicCLI...

Public Exploits

Checking GitHub for proof-of-concept code…

Related Clusters (3)

Related Entities

UNC5221 Armory Castle Dream Security Ltd Malware Zero-day Exploit Ransomware Privilege Escalation Data Breach Check Point Ivanti Uber Palo Alto Networks

CVE-2026-123039

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Public Exploits

CVE Details

Related Clusters (3)

Chinese Hackers Exploit Stolen LLM API Keys for Credential Theft via ARTEX

Attackers Exploit Check Point Vulnerabilities to Deploy Wiper Malware

Check Point CVE-2026-123039 Exploited for Local Root Access

Related Articles (22)

Hackers Use Stolen LLM API Keys to Power ARTEX AI Agents and Continue Credential Theft

Check Point Gaia CVE-2026-123039: Exploited DynamicCLI Root Escalation Added to CISA KEV

Organizations in Israel and Other Countries Hit by Check Point Firewall Exploitation

CISA Warns of Actively Exploited Check Point Zero

CVE 2026 123039

Check Point gateways hit by PHP2Shell attacks that deploy backdoors and ESXi wiper

CVE-2026-123039: Check Point Gateways Rooted, ESXi Wiped

The firewall becomes the foothold: Attackers turn Check Point gateways against customers

Hackers Chain Three Vulnerabilities to Breach Check Point Firewalls

CVE Alert: CVE-2026-123039 – checkpoint

Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiper

Unpatched Check Point Gateways Are Being Wiped exploiting PHP2Shell

Unpatched Check Point Gateways Are Being Wiped exploiting PHP2Shell

Check Point patches a zero

Hackers Exploit Check Point PHP2Shell Flaws to Gain Root Access and Deploy Wiper Malware

Check Point warns of zero-day flaw exploited for root access

Check Point warns of zero-day flaw exploited to gain root access | Межа

Hackers Exploit Check Point PHP2Shell Flaws to Gain Root Access and Deploy Wiper Malware

Attackers Exploit PHP2Shell and Gaia OS Flaws in Check Point Gateways to Deploy TSGA ...

Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files

Exploit for CVE-2026

Security Advisory: Active Exploitation of PHP2Shell and Local Privilege Escalation

Related Entities

CVE-2026-123039

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Public Exploits

CVE Details

Related Clusters (3)

Chinese Hackers Exploit Stolen LLM API Keys for Credential Theft via ARTEX

Attackers Exploit Check Point Vulnerabilities to Deploy Wiper Malware

Check Point CVE-2026-123039 Exploited for Local Root Access

Related Articles (22)

Hackers Use Stolen LLM API Keys to Power ARTEX AI Agents and Continue Credential Theft

Check Point Gaia CVE-2026-123039: Exploited DynamicCLI Root Escalation Added to CISA KEV

​Organizations in Israel and Other Countries Hit by Check Point Firewall Exploitation

CISA Warns of Actively Exploited Check Point Zero

CVE 2026 123039

Check Point gateways hit by PHP2Shell attacks that deploy backdoors and ESXi wiper

CVE-2026-123039: Check Point Gateways Rooted, ESXi Wiped

The firewall becomes the foothold: Attackers turn Check Point gateways against customers

Hackers Chain Three Vulnerabilities to Breach Check Point Firewalls

CVE Alert: CVE-2026-123039 – checkpoint

Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiper

Unpatched Check Point Gateways Are Being Wiped exploiting PHP2Shell

Unpatched Check Point Gateways Are Being Wiped exploiting PHP2Shell

Check Point patches a zero

Hackers Exploit Check Point PHP2Shell Flaws to Gain Root Access and Deploy Wiper Malware

Check Point warns of zero-day flaw exploited for root access

Check Point warns of zero-day flaw exploited to gain root access | Межа

Hackers Exploit Check Point PHP2Shell Flaws to Gain Root Access and Deploy Wiper Malware

Attackers Exploit PHP2Shell and Gaia OS Flaws in Check Point Gateways to Deploy TSGA ...

Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files

Exploit for CVE-2026

Security Advisory: Active Exploitation of PHP2Shell and Local Privilege Escalation

Related Entities

Organizations in Israel and Other Countries Hit by Check Point Firewall Exploitation