[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f7OiAvEvLfqHuxDmMEu2sorXhhDlVVH-8w0Eu7PR30PM":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":50},"8afb693b-8c71-4c8e-b48a-25e59a3f3050","unpatched-check-point-gateways-rooted-and-esxi-hosts-wiped","d23c6773-e917-487a-98eb-66a6fcf2743b","Unpatched Check Point Gateways Rooted and ESXi Hosts Wiped","Attackers exploited CVE-2026-123039, a root privilege escalation flaw in Check Point's Gaia OS combined with PHP2Shell vulnerabilities, to fully compromise unpatched gateways and install a persistent backdoor (TSGA). In several cases, the attackers went further and deployed a wiper (destroy_v6) to destroy VMware ESXi hosts, causing severe operational damage. The attacks began targeting unpatched customers within a defined window, underscoring how quickly threat actors weaponize known vulnerabilities against internet-facing security appliances. This incident highlights the critical danger of treating network security appliances as 'set and forget' devices — they require the same rigorous patch discipline as any other system, and arguably more so given their privileged position in the network.","**Immediate actions:**\n- Apply Check Point's official patch for CVE-2026-123039 to all Gaia OS gateways without delay.\n- Audit all Check Point gateways for signs of the TSGA backdoor and destroy_v6 wiper using vendor-provided indicators of compromise.\n- Restrict management interfaces of security appliances to dedicated, isolated management networks.\n\n**Long-term improvements:**\n- Establish an emergency patching SLA (e.g., 24–48 hours) for critical vulnerabilities on internet-facing security infrastructure.\n- Maintain a continuously updated inventory of all network appliances, their firmware versions, and patch status.\n- Implement network segmentation so that a compromised gateway cannot directly reach hypervisor management interfaces like ESXi.\n\n**Detection measures:**\n- Deploy file integrity monitoring and anomaly detection on security appliances to catch unauthorized binary installation such as backdoors.\n- Centralize and alert on privileged command execution logs from network appliances to detect root-level activity in real time.\n- Ensure ESXi management interfaces are monitored for unusual administrative actions, particularly bulk disk wipe operations.",[12,13,14,15,16],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 RS.MI-02: Incident Mitigation","NIS2 Article 21(2)(e)","MITRE ATT&CK T1068: Exploitation for Privilege Escalation",{"NIS2 Article 21(2)(e)":18,"NIST SP 800-53 SI-2: Flaw Remediation":19,"NIST CSF 2.0 RS.MI-02: Incident Mitigation":20,"CIS Control 7: Continuous Vulnerability Management (v8)":21,"MITRE ATT&CK T1068: Exploitation for Privilege Escalation":22},"This provision requires security in acquisition, development, and maintenance including vulnerability handling, which directly covers the obligation to patch known critical flaws in operational network security products like Check Point Gaia OS.","SI-2 mandates that organizations identify, report, and correct information system flaws within defined timeframes; adhering to this control would have ensured the Gaia OS privilege escalation flaw was patched before the attack window opened.","This category requires organizations to contain and mitigate incidents once detected; having pre-defined containment procedures would have limited lateral movement from the compromised gateway to ESXi hosts.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities on all assets, including network appliances — a process that would have identified CVE-2026-123039 and prioritized its patching before attackers exploited it.","The attackers exploited CVE-2026-123039 specifically to escalate from a lower-privileged context to root on the gateway, matching this technique's definition of using a software vulnerability to gain elevated permissions.","published","2026-11-14T04:20:40.663774+00:00","2026-11-14T04:20:40.635+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.cyberkendra.com\u002F2026\u002F11\u002Fcve-2026-123039-check-point-gateway-php2shell-wiper.html","cve-2026-123039-check-point-gateways-rooted-esxi-wiped-1d7b75","CVE-2026-123039: Check Point Gateways Rooted, ESXi Wiped",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[44],{"id":45,"date":46,"edition":47,"title":48,"audio_url":49},"705d005a-2523-4bab-9221-48bc635de4d5","2026-11-14","morning","ThreatNoir Weekend Brief — November 14","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-11-14\u002Fthreatnoir-morning-brief-2026-11-14.mp3",[51,54,58],{"slug":40,"name":52,"problem":53},"Automated patch management","Known holes get closed in days, not months.",{"slug":55,"name":56,"problem":57},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":59,"name":60,"problem":61},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else."]