CISA adds exploited Check Point Gaia root flaw to KEV catalog
CVE-2026-123039 escalates a local Gaia user to root through an unauthenticated DynamicCLI socket; the KEV deadline is November 16.
78
Product
Mobile Access
- Mentions · 7d6
- Mentions · 30d6
- All mentions6
- First seenNov 12, 2026
- Last mentioned6h ago
Timeline
6 articles · newest firstAttackers exploit Check Point gateways for root and ESXi wipes
PHP2Shell gave unauthenticated portal access, then a local bug yielded root, persistence and a wiper.
84
Unpatched Check Point gateways wiped after PHP2Shell exploitation
Two late-October waves used three CVEs for root, webshells and, in Israel, a Linux wiper.
88
Check Point patches exploited Gaia OS flaw granting root (CVE-2026-123039)
Check Point says a couple of dozen customers were hit since late October, with webshells, backdoors, and an ESXi wiper following.
84
Check Point PHP2Shell flaws exploited for root and ESXi wiper
CVE-2026-123039 on Gaia OS R81 through R82.20 followed PHP2Shell entry; named Jumbo Hotfix Takes are the fixes.
84
Unpatched Check Point gateways hit with PHP2Shell and a wiper
After a late-October fix, attackers used PHP2Shell then CVE-2026-123039, deployed TSGA, and wiped some Israeli ESXi hosts.
86
Related CVEs
by mentions- CVE-2026-1230391%7.8Local root command execution via Gaia OS DynamicCLI socket
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
Appears with
- Check Pointvendor · 6
- TSProxymalware · 6
- TSGAmalware · 6
- destroy_v6malware · 4
- Gaia OSproduct · 4
- Security Gatewayproduct · 4
- PhiliKitmalware · 3
- VMware ESXiproduct · 3
- UNC5221threat actor · 3
- Check Point Firewallproduct · 2
- ESETorganization · 2
- Check Point Researchorganization · 2
- Dream Security Ltdthreat actor · 1
- Security Management Serverproduct · 1
- gogomalware · 1
- CISAorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.