Check Point Zero-Day CVE-2026-123039 Actively Exploited

Executive Summary

A sophisticated cyberattack campaign is actively exploiting a high-severity zero-day vulnerability, CVE-2026-123039, in Check Point's Gaia operating system. The vulnerability, a local privilege escalation flaw, is the final step in an attack chain that begins with exploiting other vulnerabilities for initial access. Once attackers gain root privileges on a security gateway, they pivot to connected VMware ESXi environments to deploy destructive wiper malware. This campaign has impacted dozens of organizations globally, leading CISA to add the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, signifying a critical risk to both public and private sector entities. Immediate patching and investigation for signs of compromise are strongly recommended.

Threat Overview

The attack campaign leverages a multi-stage process to achieve its destructive goals. The initial foothold is gained by exploiting older vulnerabilities, specifically the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619), on internet-facing Check Point Security Gateways via the Mobile Access portal. After gaining initial, unprivileged access, the threat actors exploit the CVE-2026-123039 zero-day. This flaw exists in the DynamicCLI IPC interface of the Gaia OS and allows the attackers to escalate their privileges to root.

With full administrative control of the firewall, the attackers establish persistence by deploying webshells and backdoors, including malware identified as TSGA and TSProxy. The most severe impact occurs when attackers pivot from the compromised gateway to the internal network. They have been observed using SSH to connect to VMware ESXi hosts, where they deploy a wiper malware variant named destroy_v6. This malware is designed to erase virtual machines and their underlying storage, causing catastrophic data loss and operational disruption. A group calling itself "Dream Security Ltd" has been associated with some of the destructive attacks, leaving behind politically themed messages.

Technical Analysis

The attack chain demonstrates a sophisticated understanding of network security appliances and virtualized environments.

1. Initial Access: Attackers exploit T1190 - Exploit Public-Facing Application by targeting the PHP2Shell vulnerabilities on Check Point's Mobile Access portal.
2. Privilege Escalation: Once on the gateway, they use T1068 - Exploitation for Privilege Escalation by leveraging the CVE-2026-123039 flaw in the DynamicCLI service to gain root access.
3. Persistence: The attackers deploy webshells and backdoors (TSGA, TSProxy) to maintain access, aligning with T1505.003 - Server Software Component: Web Shell.
4. Lateral Movement: Using credentials from the compromised gateway, they move laterally via T1021.004 - Remote Services: SSH to connected VMware ESXi hosts.
5. Impact: The final stage involves T1485 - Data Destruction, where the destroy_v6 wiper is executed on the ESXi hosts, deleting virtual machines and their data.

The use of TSGA and TSProxy is notable, as these tools have been previously observed in attacks targeting Ivanti appliances, suggesting a possible link between the threat actors or a shared toolkit.

Impact Assessment

The impact of this campaign is severe, extending far beyond a typical data breach. The deployment of wiper malware results in the irreversible destruction of data and systems. For affected organizations, this can lead to prolonged operational outages, significant financial losses from business interruption, and costly recovery efforts. The attackers' ability to pivot from a perimeter security device to the core virtualization infrastructure highlights a critical risk in flat network architectures where security gateways have direct, privileged access to hypervisors. The targeting of Israeli organizations in the initial wave, followed by a global campaign, suggests a combination of geopolitical and opportunistic motives.

IOCs — Directly from Articles

No specific file hashes, IP addresses, or domains were provided in the source articles.

Cyber Observables — Hunting Hints

Security teams may want to hunt for the following patterns which could indicate related activity:

Detection & Response

Defenders should prioritize detecting each stage of the attack chain.

1. Initial Access: Monitor web server and Mobile Access portal logs for exploit attempts against PHP2Shell vulnerabilities. Implement Web Application Firewall (WAF) rules to block known exploit patterns.
2. Privilege Escalation: On Check Point devices, monitor for anomalous process behavior related to dynamic_server. Use endpoint detection and response (EDR) agents, if supported, to look for suspicious command execution by low-privileged services.
3. Lateral Movement: Implement network security monitoring to alert on any SSH connections from network infrastructure devices (like firewalls) to internal servers, particularly ESXi hosts. This is highly anomalous behavior. D3FEND's Network Traffic Analysis is critical here.
4. Impact: On VMware infrastructure, enable comprehensive logging and monitor for unusual VM operations such as mass deletions or modifications originating from an unexpected source. File Integrity Monitoring on ESXi hosts can detect the creation of unknown scripts or binaries like the wiper.

Mitigation

Check Point has released hotfixes to address CVE-2026-123039. Applying these patches is the most critical mitigation step.

• Patch Immediately: Apply the November Jumbo Hotfix provided by Check Point to all affected Gaia OS devices. Prioritize internet-facing Security Gateways with Mobile Access enabled. This aligns with D3FEND's Software Update countermeasure.
• Network Segmentation: As a key strategic control, enforce strict network segmentation between perimeter security devices and critical internal infrastructure like vCenter and ESXi hosts. Firewalls should not have direct, privileged SSH access to hypervisors. This is a core principle of D3FEND's Network Isolation.
• Restrict Access: Implement strict access control lists (ACLs) on management interfaces for all network and virtualization components. Limit access to a small number of hardened administrative jump hosts.
• Temporary Mitigation: If patching is not immediately possible, Check Point advises that customers can stop the dynamic_server process. However, this may impact CLI functionality and should only be considered a temporary measure.