CVE-2026-123039: Check Point Gateway Exploited in Destructive Attacks

# CVE-2026-123039: Check Point Gateway Exploited in Destructive Attacks

https://gcdradar.vercel.app/incidents/cve-2026-123039-check-point-gateway-exploited-in-destructive · AIR-2026-1943 · live

- Lane: Patch now
- Severity: 3 (Confirmed exploitation): Confirmed exploitation in the wild against real targets.
- Fix status: Patched
- First reported: 2026-11-13
- AI role: No AI role
- Products: Check Point Gateway
- CVE ids: CVE-2026-123039
- CVSS: 7.8

## Summary

Attackers exploited PHP2Shell for initial compromise alongside CVE-2026-123039 to elevate privileges to root on Check Point Gateways. The targeted attacks resulted in destructive gateway impacts.

## What to do

Apply the emergency hotfixes provided by the vendor immediately.

## Latest updates

- 2026-11-13: Added to the CISA KEV catalog (exploitation confirmed) (https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-123039)
- 2026-11-13: Vendor releases emergency hotfixes to address the flaw and prevent root access. (https://bleepingcomputer.com/news/security/check-point-patches-zero-day-that-lets-hackers-get-root-access)
- 2026-11-13: Attackers deploy the TSGA backdoor and wipe ESXi files following initial access. (https://thehackernews.com/2026/11/hackers-exploit-php2shell-flaws-in.html)
- 2026-11-13: PHP2Shell Exploited in Destructive Check Point Gateway Attacks (https://securityweek.com/php2shell-exploited-in-destructive-check-point-gateway-attacks)

## Sources

- 2026-11-13 SecurityWeek: PHP2Shell Exploited in Destructive Check Point Gateway Attacks https://securityweek.com/php2shell-exploited-in-destructive-check-point-gateway-attacks
- 2026-11-13 The Hacker News: Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files https://thehackernews.com/2026/11/hackers-exploit-php2shell-flaws-in.html
- 2026-11-13 BleepingComputer: Check Point warns of zero-day flaw exploited for root access https://bleepingcomputer.com/news/security/check-point-patches-zero-day-that-lets-hackers-get-root-access
- 2026-11-13 BleepingComputer: Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiper https://bleepingcomputer.com/news/security/check-point-gateways-hacked-via-php2shell-to-deploy-vmware-esxi-wiper
- 2026-11-13 CISA: CVE-2026-123039: Check Point Multiple Products — Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-123039

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.