Check Point Issues Emergency Patches for Vulnerabilities Exploited in Gateway Attacks

Check Point Software has released emergency hotfixes for several of its security products after discovering that threat actors have been exploiting a chain of vulnerabilities to gain root-level access to gateways.

The exploitation involves a high-severity privilege escalation flaw, tracked as CVE-2026-123039, which has been targeted since late October. Check Point confirmed that a “couple of dozen” customers have been impacted by the activity.

Chained Exploits Enable Root Access

The attack chain begins with the exploitation of “PHP2Shell,” a collective term for two critical PHP flaws: CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, rated with a severity of 9.2, allow unauthenticated remote code execution (RCE) via the Mobile Access portal.

Once initial access is achieved, attackers use the CVE-2026-123039 flaw to escalate privileges to root. This vulnerability exists in the Dynamic CLI IPC (Inter-Process Communication) interface, which sends privileged command requests to the root-level Gaia OS Dynamic CLI without sufficient identity verification.

Security researcher Frank Dickson noted that once root access is obtained, attackers can execute any command on the appliance. In observed cases, adversaries hid web shells within login page templates and installed the TSGA backdoor and TSProxy malware. These malicious tools are designed to survive reboots and can hide within the appliance’s own processes.

Lateral Movement and Destructive Malware

Beyond spying and maintaining persistence, the attackers have used the compromised gateways as a launchpad for further strikes. Reports indicate that after gaining root access, the actors pivoted from the gateway to VMware ESXi hosts via SSH.

During these movements, the group, calling itself “Dream Security Ltd,” deployed the destroy_v6 wiper and left politically themed messages. The attackers also gained the ability to copy firewall configurations, effectively obtaining a blueprint of the victim’s network.

Affected products include Check Point’s Firewall, Multi-Domain Security Management Server, Security Gateway, Security Management Server, and Scalable Platforms.

Mitigation and Defence Strategies

Check Point has advised security teams to deploy the emergency hotfixes immediately, prioritising devices that expose the Mobile Access portal to the internet. For organisations unable to patch immediately, the vendor recommends stopping the dynamic_server process to prevent its restart, though this may limit certain CLI commands.

Security experts also recommend several additional hardening measures:

• Disable Mobile Access in environments where it is not required.
• Ensure management interfaces are not accessible from the internet.
• Segment the firewall from hypervisors to prevent lateral movement to systems like VMware ESXi.
• Ship firewall logs to a remote, external system in real time to prevent attackers from altering local logs.

Because patches do not automatically evict attackers who have already established a foothold, security teams are urged to investigate for indicators of compromise and, if necessary, rebuild affected systems from trusted images.