Check Point Gateways Exploited via CVE-2026-123039: CISA KEV Entry, Wiper Attacks and What to Check

CISA added a Check Point Gaia flaw, CVE-2026-123039, to its Known Exploited Vulnerabilities (KEV) catalog on November 13, 2026, with a due date of November 16 for federal agencies. The same day, BleepingComputer and Security Affairs reported that attackers used it to take root control of unpatched Check Point gateways in a campaign that, in some cases, ended with a data-wiping tool run against VMware ESXi hosts. Here is what is confirmed, what to check, and what remains unclear.

What did CISA add to the KEV catalog?

The CISA alert lists two additions, both based on evidence of active exploitation. The KEV catalog entry (catalog version 2026.11.13) gives these details:

• CVE-2026-123039 (Check Point): an incorrect permission assignment flaw affecting Check Point Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway and Security Management Server. The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket without checking who is connecting, so an authenticated local user can send a command and have it run as root.
• CVE-2026-114713 (UnrealIRCd): an improper neutralization of delimiters flaw that lets any user on a network with two or more linked servers inject server-to-server commands that run with server authority.

Both entries carry a November 16, 2026 due date, a “forensic triage: yes” flag and an “unknown” status for use in ransomware campaigns. Under CISA’s BOD 26-04, federal agencies must remediate KEV-listed flaws on publicly exposed assets and check whether attackers got in before the patch. CISA says other organizations are encouraged, but not required, to prioritize KEV items.

How were Check Point gateways attacked?

According to BleepingComputer and Security Affairs, the attack chain looked like this:

1. Attackers got in through the gateway’s Mobile Access portal using “PHP2Shell”, the name given to two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution.
2. They used CVE-2026-123039 to move from the portal’s service account to root.
3. They planted PHP webshells and a backdoor called TSGA, which carries a proxy component named TSProxy.
4. In the Israeli cases, they mapped the internal network with the open-source gogo scanner and moved over SSH to a VMware ESXi host.
5. There they ran a Linux wiper named destroy_v6, which deletes files in a target folder and, unless run in a fast mode, overwrites them with zeros first.

The first wave began on October 30 against Israeli organizations, and some of those suffered destructive attacks. A second wave on November 2 hit organizations in several countries and sectors; Check Point says it saw no destructive activity in that wave. Neither report names a victim or gives a count.

Is there a patch?

Yes. BleepingComputer says Check Point recommends installing its November Jumbo Hotfix on all Management Servers and Security Gateways, starting with internet-facing Mobile Access portals; the hotfix addresses PHP2Shell and the DynamicCLI flaw. Security Affairs says a fix for the PHP2Shell flaws had been available about a week before the attacks began. Neither article lists fixed build numbers, so check Check Point’s advisory for CVE-2026-123039 (sk1000362, linked in CISA’s KEV entry) for the exact releases that apply to your version.

Update, November 14, 2026: Check Point’s advisory sk1000362 lists the builds that fix CVE-2026-123039: the Jumbo Hotfix Accumulator for R82.20 from Take 14, R82.10 from Take 52, R82 from Take 132 and R81.20 from Take 174. It lists R81.10 and R81 as affected with no fix, and gives a mitigation: stop the dynamic_server process (this breaks the Dynamic CLI commands listed in sk144112). After patching, blocked calls are logged as “Rejected connection from unauthorized uid” in /var/log/dynamicCli.log; Check Point says an unexpected UID there points to an escalation attempt.

What should administrators check?

The two reports list these signs of compromise, which Check Point and researchers published:

• PHP session files containing the string upload_progress_pwn, and repeated Apache or PHP crashes.
• Unexpected CPconfigdaemon processes or binaries, such as /tmp/CPconfigdaemon.
• Webshell files named zz*.tpl in the portal’s login-page folder.
• Unexplained gaps in firewall logs, which BleepingComputer lists as an indicator.
• Unauthorized SSH connections from a gateway to internal ESXi hosts, which BleepingComputer calls a clear sign of breach.
• Scanning from IP address 130.94.19[.]204 and traffic on TCP port 11072.

Patching alone does not remove a backdoor that is already installed, which is why CISA attaches forensic triage to this entry. If the Mobile Access portal is not needed on a gateway, turning it off or limiting it to known addresses reduces exposure; that is general hardening advice, not a step from the reports above.

Who is behind it?

That is not settled. Check Point tentatively links TSGA and TSProxy to PhiliKit, a framework seen in attacks on Ivanti devices that ESET associated with a China-linked cluster, UNC5221. But the wiper note, called DREAM_ANNEXATION.txt, is written in Hebrew, carries political messages and rejects ransom talks. In Check Point’s words, the evidence “does not allow us to assess with high confidence the true nature of this operation.” It lists three possibilities: one actor ran the whole campaign, the actor was only an initial-access broker, or the operation was a false flag, and it adds that the destructive activity may have been a smoke screen.

Sources

• CISA: Two Known Exploited Vulnerabilities added to catalog (Nov 13, 2026) and its KEV catalog
• BleepingComputer: Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiper
• Security Affairs: Unpatched Check Point gateways are being wiped

Image: Avi1111 dr. avishai teicher / CC BY-SA 4.0 via Wikimedia Commons.

Like our coverage? Add stepphase.com as a preferred source on Google to see more of our stories in Top Stories.