The firewall becomes the foothold: Attackers turn Check Point gateways against customers

Publisher excerpt From CSO Online

A firewall is intended to be a boundary attackers can’t cross. But firewalls face the web, making them just as vulnerable to attack as other systems, as evidenced by the emergency hotfixes released by Check Point Software for several of its products. The patches address a high-severity privilege escalation flaw, CVE-2026-123039, that gives attackers root privilege access and the ability to send commands to the Gaia OS Dynamic CLI daemon, a core background process. Hackers have been exploiting the 7.8-rated vulnerability since late October, and Check Point said “a couple of dozen” customers have been impacted. Perhaps not surprisingly, adversaries gained initial access via PHP2Shell, the collective name for two critical PHP flaws tracked as CVE-2026-109618 and CVE-2026-109619. The 9.2-severity-rated bugs allow unauthenticated remote code execution (RCE). “For customers, one foothold delivered the full menu: Spying, staying, and destroying,” said Frank Dickson of Dickson Research. “For Check Point, the cost is trust. A firewall is supposed to be the strongest point in the network, not the softest.” Granting unintended root access CVE-2026-123039 is a bug in the Dynamic CLI IPC (Inter-Process Communication) interface which sends privileged command requests to the root-level Gaia OS Dynamic CLI. It is a local privilege escalation flaw, meaning an attacker already has to have local code execution ability on the appliance; this accounts for its 7.8 rating. Attackers first gained access to the Mobile Access portal by exploiting the PHP2Shell vulnerabilities. They then escalated privileges to root using the CVE-2026-123039 zero-day exploits. “Once attackers have root, they can run anything they like,” Dickson said. A management service on the appliance runs as root, listens on a local socket that any process on the box can write to, and never checks who is calling. In this case, the attackers hid web shells inside the templates the portal uses to build its login page, and installed a TSGA backdoor and TSProxy malware that survives reboots, tucks itself into backups and snapshots, and hides inside the appliance’s own processes, he explained. “That backdoor can copy the firewall configuration, which is essentially a blueprint of the network,” he said. It can also alter the firewall’s logs, concealing the attacker’s activities. Check Point reported that, after gaining root access, the attackers then pivoted from the compromised gateway to a VMware ESXi host over SSH, deployed the destroy_v6 wiper, and left politically themed messages signed by a group calling itself Dream Security Ltd during the destructive stage. Check Point advised security teams to immediately deploy the CVE-2026-123039 hotfixes, beginning with devices that expose Mobile Access to the internet. Those who can’t do so right away should stop the dynamic_server process and prevent it from restarting. However, they warned, this can come at the cost of some CLI commands. Dickson…

Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.