Check Point Zero-Day CVE-2026-123039: How Attackers Chained Root Escalation with ESXi Wiper Deployment
In late October 2026, threat actors began actively exploiting CVE-2026-123039, a zero-day local privilege escalation vulnerability in Check Point's Gaia OS DynamicCLI IPC interface. Attackers first gained initial access through the Mobile Access portal via PHP2Shell vulnerabilities, then escalated to root privileges using the unauthenticated world-writable socket (/tmp/dynamic_socket). After achieving root access, adversaries deployed webshells, the TSGA backdoor, and TSProxy malware — tools previously observed in Ivanti appliance attacks — before pivoting to VMware ESXi hosts and deploying destructive wiper malware across dozens of customer environments. This incident is emblematic of an accelerating pattern in which sophisticated threat actors chain perimeter device vulnerabilities with privilege escalation zero-days to achieve deep persistence and deploy destructive payloads. The reuse of tools like TSGA and TSProxy across Check Point and Ivanti campaigns signals a maturing, cross-platform intrusion playbook that security teams must recognize and counter proactively.
Kill Chain
