{"id":10422,"date":"2026-11-14T01:39:15","date_gmt":"2026-11-14T01:39:15","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=10422"},"modified":"2026-11-14T01:39:15","modified_gmt":"2026-11-14T01:39:15","slug":"the-firewall-becomes-the-foothold-attackers-turn-check-point-gateways-against-customers","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=10422","title":{"rendered":"The firewall becomes the foothold: Attackers turn Check Point gateways against customers"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

A firewall is intended to be a boundary attackers can\u2019t cross.<\/p>\n

But firewalls face the web, making them just as vulnerable to attack as other systems, as evidenced by the emergency hotfixes<\/a> released by Check Point Software for several of its products. The patches address a high-severity privilege escalation flaw, CVE-2026-123039<\/a>, that gives attackers root privilege access and the ability to send commands to the Gaia OS Dynamic CLI daemon, a core background process.<\/p>\n

Hackers have been exploiting the 7.8-rated vulnerability since late October, and Check Point said \u201ca couple of dozen\u201d customers have been impacted.<\/p>\n

Perhaps not surprisingly, adversaries gained initial access via PHP2Shell<\/a>, the collective name for two critical PHP flaws tracked as CVE-2026-109618 and CVE-2026-109619. The 9.2-severity-rated bugs allow unauthenticated remote code execution (RCE).<\/p>\n

\u201cFor customers, one foothold delivered the full menu: Spying, staying, and destroying,\u201d said Frank Dickson<\/a> of Dickson Research. \u201cFor Check Point, the cost is trust. A firewall is supposed to be the strongest point in the network, not the softest.\u201d<\/p>\n

Granting unintended root access<\/h2>\n

CVE-2026-123039 is a bug in the Dynamic CLI IPC (Inter-Process Communication) interface which sends privileged command requests to the root-level Gaia OS Dynamic CLI. It is a local privilege escalation flaw, meaning an attacker already has to have local code execution ability on the appliance; this accounts for its 7.8 rating.<\/p>\n

Attackers first gained access to the Mobile Access portal by exploiting the PHP2Shell vulnerabilities<\/a>. They then escalated privileges to root using the CVE-2026-123039 zero-day exploits.<\/p>\n

\u201cOnce attackers have root, they can run anything they like,\u201d Dickson said. A management service on the appliance runs as root, listens on a local socket that any process on the box can write to, and never checks who is calling.<\/p>\n

In this case, the attackers hid web shells inside the templates the portal uses to build its login page, and installed a TSGA backdoor and TSProxy malware that survives reboots, tucks itself into backups and snapshots, and hides inside the appliance\u2019s own processes, he explained.<\/em><\/p>\n

\u201cThat backdoor can copy the firewall configuration, which is essentially a blueprint of the network,\u201d he said. It can also alter the firewall\u2019s logs, concealing the attacker\u2019s activities.<\/p>\n

Check Point reported that, after gaining root access, the attackers then pivoted from the compromised gateway to a VMware ESXi host over SSH, deployed the destroy_v6 wiper, and left politically themed messages signed by a group calling itself Dream Security Ltd during the destructive stage.<\/p>\n

Check Point advised security teams to immediately deploy the CVE-2026-123039 hotfixes, beginning with devices that expose Mobile Access to the internet. Those who can\u2019t do so right away should stop the dynamic_server<\/em> process and prevent it from restarting. However, they warned, this can come at the cost of some CLI commands.<\/p>\n

Dickson also advised customers to turn off Mobile Access where it is not used, keep management interfaces off the internet entirely, and run the advisory\u2019s log checks on any gateway exposed since late October, then cut the cord between the firewall and the hypervisor. A potentially exposed gateway should never have a trusted path into VMware ESXi.<\/p>\n

They should also ship firewall logs off the box, as they happen, to a system the firewall cannot touch.<\/p>\n

Products impacted by CVE-2026-123039 include Check Point\u2019s Firewall, Multi-Domain Security Management Server, Security Gateway, Security Management Server, and Scalable Platforms.<\/p>\n

Security tools are as big a target as what they protect<\/h2>\n

Once attackers have root access, the device basically becomes a trusted launching point for attacks against other systems that would otherwise stay protected, explained Erik Avakian<\/a>, a technical counselor at Infotech. By effectively controlling the gateway, they can execute a wide array of nefarious actions.<\/p>\n

The overall takeaway and irony of this, Avakian pointed out, is that the very technology organizations deploy to protect themselves can become one of their greatest vulnerabilities.<\/p>\n

\u201cOrganizations can no longer assume their security infrastructure is inherently secure simply because it\u2019s designed to provide protection,\u201d he said. In reality, it is as much of a target as the systems it\u2019s protecting.<\/p>\n

Firewalls, VPN appliances, and security gateways are increasingly being targeted because they provide the greatest leverage and control, he noted. As such, security teams must treat these appliances as high value assets with the same access control safeguards, vulnerability management, monitoring, and incident response rigor applied to other critical infrastructure.<\/p>\n

This means aggressively patching internet facing systems, restricting management access, monitoring for unusual administrative activity, and looking for indications of persistence or lateral movement, he said. But patches don\u2019t evict already established attackers, so security teams must investigate and, where necessary, rebuild affected systems from trusted images.<\/p>\n

And with AI accelerating attacks<\/a>, CISOs should consider establishing a zero trust mindset and architecture collectively across the pillars of identity, network, applications, data, and devices, he said.<\/p>\n

Keep an eye on the edge<\/h2>\n

Edge devices are primary targets, as they sit at the boundary, hold privileged access, and rarely get the endpoint monitoring that other systems do, noted Scott Miserendino<\/a>, CTO at DataBee. Security appliances should be treated as the high-risk assets they\u2019ve become.<\/p>\n

In addition to patching and applying mitigations, he advised, defenders should assume there\u2019s been a breach, hunting for published indicators of compromise (IOCs), routinely investigating network and endpoint security logs, and segmenting networks to reduce blast radius. \u201cSecurity tools aren\u2019t automatically secure, so defend the defenders,\u201d he said.<\/p>\n

And, Dickson pointed out, PHP2Shell will keep showing up because PHP sits underneath so much web software, including the portals bolted onto security appliances, so it should always be on defenders\u2019 radar.<\/p>\n

The management plane is a key target<\/h2>\n

Check Point is not alone as a victim of threat actors. Firewall management has become a favorite target for attackers across the industry.<\/p>\n

In January, for instance, Fortinet disclosed<\/a> that attackers abused its FortiCloud single sign-on to log into other customers\u2019 FortiGate and FortiManager devices and create administrator accounts. In July and September<\/a>, CISA added Check Point management server flaws to its catalog of exploited vulnerabilities.<\/p>\n

That same month, the agency also added a Cisco Secure Firewall Management Center flaw, rated a perfect 10.0 in severity, that hands an unauthenticated attacker root access. And, in October, Palo Alto Networks warned of attacks<\/a> on the PAN-OS management interface, again with \u201croot on the firewall as the prize.\u201d<\/p>\n

\u201cThe logic is simple,\u201d Dickson said: \u201cThe management plane holds the rulebook for the entire network.<\/p>\n

Changing providers to one with fewer flaws is an option, but swapping vendors swaps one Achilles\u2019 heel for another, he pointed out, as every vendor\u2019s edge device has a web portal, and every web portal is a door. \u201cThe remedy is fewer doors,\u201d he advised. \u201cShrink the internet-facing edge and put remote access behind one consistent identity policy.\u201d<\/p>\n

Ultimately, he noted, a firewall is not a wall, it is a computer sitting on the internet. \u201cAttackers are treating it like one,\u201d he said. \u201cSecurity teams should defend it like one.\u201d<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

A firewall is intended to be a boundary attackers can\u2019t cross. But firewalls face the web, making them just as vulnerable to attack as other systems, as evidenced by the emergency hotfixes released by Check Point Software for several of its products. The patches address a high-severity privilege escalation flaw, CVE-2026-123039, that gives attackers root […]<\/p>\n","protected":false},"author":0,"featured_media":10423,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-10422","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10422"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10422"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10422\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/10423"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10422"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10422"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10422"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}