[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fTcywfYmN0-dZVR-iyQDYa02SPsEFvs3lZD3NCvABSa4":3},{"article":4,"iocs":52,"watch_terms":71,"solutions":72,"lesson":167},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"be543fd3-83d4-4bdc-9b9d-202f13a522f9","Hackers Exploit Check Point Firewall Flaws to Gain Root Access and Deploy Wiper Malware on VMware ESXi","hackers-exploit-check-point-firewall-flaws-to-gain-root-access-and-deploy-wiper-e51b13","Hackers have chained Check Point firewall vulnerabilities to gain root access, plant backdoors, and deploy destructive malware on a VMware ESXi host. The campaign began on October 30, 2026, targeting Israeli organizations before expanding worldwide. Check Point confirmed that attackers exploited the privilege escalation flaw against a couple of dozen customers. The supplied investigation describes […] The post Hackers Exploit Check Point Firewall Flaws to Gain Root Access and Deploy Wiper Malware on VMware ESXi appeared first on Cyber Security News.","Attackers chained Check Point firewall vulnerabilities to gain root access, plant backdoors, and deploy wiper malware on VMware ESXi hosts. The campaign, which began on October 30, 2026, initially targeted Israeli organizations before expanding globally. Check Point confirmed the privilege escalation flaw was exploited against a couple of dozen customers, with affected releases ranging from R81 to R82.20.","Hackers exploit Check Point firewall flaws, deploy wiper malware on VMware ESXi.","https:\u002F\u002Fcybersecuritynews.com\u002Fhackers-exploit-check-point-firewall-flaws\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FHackers-Exploit-Check-Point-Firewall-Flaws-to-Gain-Root-Access-and-Deploy-Wiper-Malware-on-VMware-ESXi.webp","2026-11-13T06:38:59+00:00","2026-11-13T08:00:28.2642+00:00",9,[17,20,23,26],{"name":18,"type":19},"Check Point","vendor",{"name":21,"type":22},"VMware ESXi","product",{"name":24,"type":25},"Gaia operating system","technology",{"name":27,"type":28},"UNC5221","threat_actor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":29,"icon":31,"name":32,"slug":33},null,"Vulnerabilities","vulnerabilities",[35,40,42,47],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":41},{"id":29,"icon":31,"name":32,"slug":33},{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":48},{"id":49,"icon":31,"name":50,"slug":51},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[53,57,59,62,65,68],{"type":54,"value":55,"context":56},"cve","CVE-2026-109618","Used for initial access via vulnerable Check Point Mobile Access portals.",{"type":54,"value":58,"context":56},"CVE-2026-109619",{"type":54,"value":60,"context":61},"CVE-2026-123039","Exploited to gain root access on the Gaia operating system's DynamicCLI service.",{"type":46,"value":63,"context":64},"destroy_v6","Wiper malware deployed on VMware ESXi hosts.",{"type":46,"value":66,"context":67},"TSGA","Persistent Linux backdoor installed by attackers.",{"type":46,"value":69,"context":70},"TSProxy","Component of TSGA backdoor, used for hidden attacker connections.",[18,21],{"controls":73,"vendors":161},[74,103,132],{"slug":75,"name":76,"problem":77,"products":78},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[79,87,95],{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"slug":104,"name":105,"problem":106,"products":107},"patch-management","Automated patch management","Known holes get closed in days, not months.",[108,116,124],{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":133,"name":134,"problem":135,"products":136},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[137,145,153],{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":149,"product_name":150,"url":151,"description":152},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":154,"vendor_name":155,"vendor_logo":156,"product_slug":157,"product_name":158,"url":159,"description":160},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",[162],{"slug":163,"name":18,"logo_path":164,"roles":165},"check-point","\u002Fvendor-logos\u002Fcheck-point.png",[166],"affected",{"slug":168,"title":169,"body":170,"framework_refs":171,"framework_notes":177},"chained-firewall-flaws-enable-root-access-and-wiper-deployment-on-esxi-hosts","Chained Firewall Flaws Enable Root Access and Wiper Deployment on ESXi Hosts","Attackers chained multiple Check Point firewall vulnerabilities to escalate privileges to root, plant persistent backdoors, and ultimately deploy destructive wiper malware on VMware ESXi hypervisors — a critical layer of infrastructure. The campaign affected dozens of customers across multiple software releases (R81–R82.20), indicating that many organizations had not applied available patches in a timely manner. Security appliances such as firewalls are high-value targets precisely because they sit at the perimeter and, when compromised, grant attackers deep network access. Chaining privilege escalation flaws with destructive payloads on hypervisors can wipe entire virtualized environments in one campaign, magnifying the blast radius significantly. This incident underscores that network security devices are not immune to vulnerabilities and must be subject to the same rigorous patch and vulnerability management programs as any other system.",[172,173,174,175,176],"CIS Control 7: Continuous Vulnerability Management (v8)","CIS Control 2: Inventory and Control of Software Assets (v8)","NIST SP 800-53 SI-2: Flaw Remediation","MITRE ATT&CK T1068: Exploitation for Privilege Escalation","NIS2 Article 21(2)(e)",{"NIS2 Article 21(2)(e)":178,"NIST SP 800-53 SI-2: Flaw Remediation":179,"CIS Control 7: Continuous Vulnerability Management (v8)":180,"MITRE ATT&CK T1068: Exploitation for Privilege Escalation":181,"CIS Control 2: Inventory and Control of Software Assets (v8)":182},"NIS2 Article 21(2)(e) explicitly requires vulnerability handling and disclosure practices in acquisition and maintenance processes, meaning operators of critical infrastructure were obligated to have patching procedures that would have addressed these known firewall flaws promptly.","SI-2 mandates that organizations identify, report, and correct information system flaws within organizationally defined time periods — an enforced patching window would have closed the privilege escalation vulnerability before attackers could chain it.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities in all assets, including security appliances like firewalls — timely patching of the chained Check Point flaws would have prevented initial exploitation.","Attackers exploited Check Point firewall vulnerabilities specifically to escalate to root, which is precisely the technique T1068 describes, and detection controls aligned to this technique would have flagged the escalation early.","Knowing exactly which firewall software versions were deployed across the estate is prerequisite to identifying exposure to the R81–R82.20 vulnerabilities and prioritizing remediation."]