Check Point firewall flaws chained for root access and ESXi wiper
Original title: Hackers Exploit Check Point Firewall Flaws to Gain Root Access and Deploy Wiper Malware on VMware ESXi
Check Point says a couple of dozen customers were hit in two waves from October 30, with wipers used against some Israeli targets.
Attackers chained Check Point Mobile Access flaws CVE-2026-109618 and CVE-2026-109619 with local privilege escalation CVE-2026-123039 to gain root on Gaia, plant PHP webshells and the TSGA backdoor, then reach VMware ESXi over SSH as vpxuser. The first wave, from October 30, included destructive destroy_v6 activity against some Israeli targets; a November 2 wave hit several countries with no evidence of data destruction. Check Point Research notes code overlap with PhiliKit and UNC5221 but does not attribute the operation. Fixes start at named Jumbo Hotfix takes; Spark Firewalls and Smart-1 Cloud are unaffected.
Unconfirmed: Check Point found PhiliKit code overlap with UNC5221 but no evidence identifying who ran this operation.
- CVE-2026-123039 is rated 7.8 and needs prior local access.
- Affected releases run from R81 through R82.20, including management, logging and Maestro.
- Fixed takes include R82.20 Take 14, R82.10 Take 52, R82 Take 132 and R81.20 Take 174.
- Notes named DREAM_ANNEXATION.txt rejected ransom negotiations.
- Patched dynamic sockets should be mode 0660 and owned by root config.
Impact: Root on Gaia firewalls and file-wiping on ESXi hosts
| Product | Affected | Fixed in |
|---|---|---|
| Check Point Gaia and related products | R81 through R82.20, including management, logging and Maestro | R82.20 Take 14, R82.10 Take 52, R82 Take 132, R81.20 Take 174 |
- 1.Install the listed Jumbo Hotfix takes for affected R81 through R82.20 products.
- 2.Review /var/log/dynamicCli.log for commands outside the normal Clish wrapper.
- 3.Check that dynamic sockets are mode 0660 and owned by root config.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1068 Exploitation for Privilege EscalationT1505.003 Web ShellT1021.004 SSHT1485 Data Destruction
- Vendors
- Check PointVMware
- Organizations
- Check Point Research
- Countries
- Israel
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-123039 | Local root command execution via Gaia OS DynamicCLI socket | 7.8 | 1% | KEV | KEV |
From the original article
2 min read at cybersecuritynews.com
Hackers have chained Check Point firewall vulnerabilities to gain root access, plant backdoors, and deploy destructive malware on a VMware ESXi host. The campaign began on October 30, 2026, targeting Israeli organizations before expanding worldwide. Check Point confirmed that attackers exploited the privilege escalation flaw against a couple of dozen customers.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.