Unpatched Check Point Gateways Leveraged to Wipe VMware ESXi Infrastructure
Written by AI from the linked story. Not reviewed by an editor. How this works
Attackers exploited two known PHP vulnerabilities in Check Point Security Gateway appliances and chained them with a zero-day privilege escalation to gain deep footholds — ultimately deploying a destructive wiper against VMware ESXi hosts. The incident illustrates how a single unpatched internet-facing appliance can serve as a launchpad for lateral movement into the most critical layers of infrastructure. Security gateways are high-value, high-exposure targets precisely because they sit at the perimeter, yet they are frequently behind on patches due to concerns about downtime. The deployment of the destroy_v6 wiper underscores that some threat actors have no interest in negotiation — their goal is irreversible destruction, making rapid detection and isolation essential.
Tactical Insight
Immediate actions
- Apply Check Point patches for CVE-2026-109618, CVE-2026-109619, and CVE-2026-123039 immediately, or isolate affected gateways until patching is possible.
- Audit all internet-facing Security Gateway instances for signs of webshell installation or unexpected outbound connections to ESXi management interfaces.
- Restrict management access to VMware ESXi hosts to dedicated, isolated administrative networks with no direct reachability from DMZ or gateway segments.
Long-term improvements
- Establish an emergency patching SLA (e.g., 24–48 hours) for critical vulnerabilities on perimeter security appliances.
- Implement network segmentation so that compromise of a perimeter gateway cannot provide direct routed access to hypervisor management planes.
- Maintain immutable, offline backups of ESXi datastores and VM snapshots so wiper-based attacks cannot achieve total data destruction.
Detection measures
- Deploy file-integrity monitoring and anomaly detection on security appliances to alert on unexpected file writes (e.g., webshells, new binaries) in web-accessible directories.
- Monitor ESXi management interfaces for authentication events and administrative commands originating from non-administrative source IPs.
- Enable centralized, tamper-resistant logging for all perimeter devices so attacker activity is preserved even if the appliance is subsequently wiped.