What Happened
The Check Point privilege escalation vulnerability affects multiple products, and Check Point indicates that CVE-2026-123039 is exploited in the wild. For an MSP, the cost is not the patch itself. It is the hours after a client gateway is rooted.
An attacker with root can deploy a backdoor and wipe ESXi files, according to Hackernews. That means emergency response, restore work, and a client asking why their environment was down.
Securityweek reported that PHP2Shell enabled initial compromise, while CVE-2026-123039 allowed attackers to elevate privileges to root. Hackernews reported that the activity, detailed by Check Point, began on October 30, 2026 and targeted Israeli organizations, with a broader follow-up wave.
Timeline
- October 30, 2026: Activity detailed by Check Point began, according to Hackernews. The activity targeted Israeli organizations.
- November 12, 2026: As of this date, Check Point is affected by vulnerabilities in its Force Firewalls, Management and Log Servers, Multi-Domain Security Management and Multi-Domain Log Server, and Maestro Orchestrator products, all across multiple versions.
- November 13, 2026: Securityweek published a report on the destructive Check Point gateway attacks.
- November 13, 2026: Hackernews published a report on the TSGA backdoor and wiped ESXi files.
Who Is Affected
MSPs with clients running affected Check Point products are in scope. The affected products are Check Point Force Firewalls, Management and Log Servers, Multi-Domain Security Management and Multi-Domain Log Server, and Maestro Orchestrator, all across multiple versions.
Hackernews reported that the activity detailed by Check Point targeted Israeli organizations, with a broader follow-up wave. Any MSP with unpatched gateways in those product lines should treat this as an active incident risk.
Why This Matters to MSPs
A firewall or management server is a high-value target because it sits in front of everything else. Root on that system can mean control over network rules, VPN access and logging. If the attacker also wipes ESXi files, the recovery clock starts at the hypervisor.
For an MSP, the bill comes in three parts: emergency response hours, restore and validation time, and client confidence. The technical fix is only one part of the work.
The affected products may not be in every client environment. Where they are, the exposure is serious because a rooted gateway is a trusted position on the network.
Technical Details: Check Point Privilege Escalation Vulnerability
CVE-2026-123039 is a local privilege escalation to root in the DynamicCLI process via a local world-writable control socket. Check Point indicates that this flaw is being exploited in the wild.
CVE-2026-107484 is an input validation flaw in Gaia Portal backend handlers that allows privilege escalation by an authenticated user.
Securityweek reported that PHP2Shell enabled initial compromise, while CVE-2026-123039 allowed attackers to elevate privileges to root.
Hackernews reported that an unknown threat actor targeted unpatched Check Point Security Gateways to obtain initial access via the PHP2Shell vulnerabilities and then a previously reported local privilege escalation flaw in Gaia OS to deploy a backdoor called TSGA and wipe ESXi files.
What MSPs Should Do
Check Point's stated action is to review the provided web links and apply any necessary updates as they become available. As a standing practice, treat a gateway with root-level compromise as untrusted and plan recovery before you need it.
- Inventory every Check Point Force Firewall, Management and Log Server, Multi-Domain Security Management and Multi-Domain Log Server, and Maestro Orchestrator across your clients.
- Apply vendor updates or mitigations as they become available. If no update is available, restrict management and local access to trusted networks and accounts.
- If a gateway is suspected of compromise, isolate it, preserve logs, and rebuild from known good configuration. Do not rely on cleaning in place after root access.
- Verify backups for ESXi hosts and any systems protected by the gateway. Test that you can restore without the compromised host.
- Review local accounts and control sockets on affected systems. Remove unnecessary access and monitor for unusual local privilege use.
- Document client communication and the recovery steps you took, so the incident response trail is clear.
How EnterProtect Helps
EnterProtect backup keeps clean restorable copies of client systems, so an MSP can recover after destructive activity. EnterProtect recovery helps get a client running again when a gateway or protected host has to be rebuilt.
EnterProtect vulnerability scanning helps MSPs keep an inventory view of exposed software versions as a standing practice. It does not replace patching or incident response.
Frequently Asked Questions
What Is CVE-2026-123039?
CVE-2026-123039 is a local privilege escalation to root in the DynamicCLI process via a local world-writable control socket. Check Point indicates that this flaw is being exploited in the wild.
Which Check Point Products Are Affected?
Check Point Force Firewalls, Management and Log Servers, Multi-Domain Security Management and Multi-Domain Log Server, and Maestro Orchestrator are affected, all across multiple versions. MSPs should check every client running those products.
Is CVE-2026-123039 Exploited in the Wild?
Yes. Check Point indicates that CVE-2026-123039 is being exploited in the wild. Securityweek reported that this flaw allowed attackers to elevate privileges to root.
What Should an MSP Do If a Client Has an Affected Check Point Gateway?
Check Point's stated action is to review the provided web links and apply any necessary updates as they become available. As a standing practice, inventory affected products, restrict management access, and treat any suspected root compromise as a rebuild, not a cleanup.
What Is PHP2Shell in This Incident?
Securityweek reported that PHP2Shell enabled initial compromise, while CVE-2026-123039 allowed attackers to elevate privileges to root. Hackernews reported that an unknown threat actor used PHP2Shell vulnerabilities for initial access before deploying the TSGA backdoor and wiping ESXi files.
Can a Check Point Gateway With Root Compromise Be Cleaned in Place?
Security practice is to treat a system with root-level compromise as untrusted. Rebuild from known good configuration and restore data from clean backups. Do not assume removing a backdoor makes the system safe.
Sources
- PHP2Shell Exploited in Destructive Check Point Gateway Attacks (Securityweek)
- Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files (Hackernews)