Check Point says hackers used firewall zero-day CVE-2026-123039 to wipe data at Israeli organizations

What happened

Check Point Software released emergency hotfixes for CVE-2026-123039, a high-severity flaw that attackers have exploited since late October 2026 to gain root privileges on vulnerable devices, BleepingComputer reported on November 13. "Check Point observed an active exploit of this vulnerability against a couple of dozen customers," the company said in its security advisory.

The flaw is in the DynamicCLI service of Gaia OS, the operating system that runs on Check Point firewalls. Check Point said the service runs as root and carries out any command it receives from a local user without checking who sent it. The company rates the flaw high, with a score of 7.8 out of 10. The flaw only works for an attacker who can already run code on the device, Check Point said.

In a report published November 12, Check Point Research said the attackers got that first foothold through PHP2Shell, two flaws in the PHP programming language tracked as CVE-2026-109618 and CVE-2026-109619. They broke in through Mobile Access portals, web login portals on Check Point security gateways, and then used CVE-2026-123039 to take full control. SecurityWeek and The Hacker News reported the same sequence.

How the attacks unfolded

The attacks came in two waves, according to Check Point Research. The first, on October 30, 2026, targeted Israeli organizations and included destructive activity against some of them. Check Point said it began about one week after a fix for the PHP2Shell flaws became available.

After gaining root, the attackers installed web shells, small scripts that give attackers remote control of a server through a web page, Check Point said. They then installed a persistent backdoor called TSGA, which Check Point said can steal firewall configurations and tamper with firewall logs.

From the gateway, the attackers moved to a VMware ESXi host, a server that runs virtual machines, and ran a wiper called Destroy v6, according to Check Point. A wiper is malware that destroys data. Check Point said this wiper deletes files in the folders it targets and by default overwrites them with zeros first. The attackers left a politically themed note that used the brand of Israeli security company Dream, Check Point said.

The second wave, on November 2, targeted organizations across multiple countries and sectors, including some Israeli organizations hit in the first wave. Check Point found no evidence of destructive activity in the second-wave intrusion it investigated. "Neither wave showed a clear sector preference, suggesting opportunistic initial-access attempts rather than sector-specific targeting," Check Point said.

Who is affected

According to Check Point's advisory, CVE-2026-123039 affects Check Point Force firewalls, management and log servers, Multi-Domain Security Management and Multi-Domain Log Servers, and the Maestro Orchestrator. The affected versions are R82.20, R82.10, R82, R81.20, R81.10, and R81. Check Point lists R81 and R81.10 as end of support. Check Point Spark firewalls and Smart-1 Cloud are not affected.

The PHP2Shell flaws affect Check Point firewalls that use web-facing features such as the Mobile Access portal, remote access VPN with SSL Network Extender or SAML login, the Identity Awareness captive portal, the UserCheck portal, or Zero Phishing, according to a separate Check Point advisory. Check Point said it provided a hotfix for the two PHP2Shell flaws on October 23, 2026.

Who is behind the attacks

Check Point said the TSGA backdoor and its networking component, TSProxy, are variants of PhiliKit, a malware family associated with the China-nexus group UNC5221 and earlier attacks on Ivanti appliances. The Hacker News reported that ESET first documented PhiliKit in June 2026 and attributed it to a group it tracks as Armory Castle, formerly UNC5221. Check Point also noted that the attackers used hosting associated with China-nexus actors and scanned mostly during Chinese working hours.

The wiper, the focus on Israel, and a note in Hebrew referring to the Israeli-Palestinian conflict do not fully align with that group's known motives, Check Point said. "Taken together, the evidence does not allow us to assess with high confidence the true nature of this operation," Check Point said. It listed several possibilities: the identified actor ran the whole campaign, acted only as an initial access broker that sells or hands off access, or staged a false-flag operation. The destruction may also have served as a smoke screen.

Dream had recently published research on PHP2Shell attacks on Palo Alto Networks devices by China-nexus actors, Check Point said. It added that this timing raises the possibility of retaliation, but the evidence does not establish a clear motive.

What organizations should do

Check Point fixed CVE-2026-123039 in the Jumbo Hotfix Accumulator for R82.20 starting with Take 14, R82.10 with Take 52, R82 with Take 132, and R81.20 with Take 174. For systems that cannot be updated right away, Check Point advises stopping the vulnerable DynamicCLI process and preventing it from restarting, which causes some Dynamic CLI commands to fail. The advisory also explains how to check the service's log for commands that may have been run as root through the flaw.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-123039 to its Known Exploited Vulnerabilities (KEV) catalog on November 13, 2026, based on evidence of active exploitation. The catalog entry gives federal civilian agencies until November 16 to apply Check Point's mitigations, or to stop using the product if mitigations are unavailable. CISA's Binding Operational Directive (BOD) 26-04 also sets expectations for when agencies must check whether a system was compromised before the patch was applied.

Check Point Research published the indicators of compromise for the campaign in its report.