Act today High Patch available CVSS 7.8 (NVD)
Attackers broke into Check Point gateways, then wiped a VMware server
Check Point ResearchCheck Point Security Gateways, VMware ESXiCVE-2026-123039
What happened. Check Point Research describes attacks from 30 October 2026 on unpatched Security Gateways using Mobile Access portals. Attackers used PHP2Shell and flaw CVE-2026-123039, planted backdoors, moved to a VMware ESXi host over SSH and deployed a wiper.
Who is affected. Organisations with unpatched Check Point Security Gateways using Mobile Access portals. Industrial sites using them for remote access are exposed, because vendors and engineers often reach plant systems this way.
What to do. Check whether your Check Point Security Gateways expose Mobile Access portals, and apply the vendor patches for CVE-2026-123039.
When to act. Act today: Operators with Check Point gateways: exploitation under way; check Mobile Access and patch now.
Editor's reading
ForOT security leaddetection engineerIT security
- Purdue level
- L5
- L3.5
Why: A boundary gateway with a remote-access portal is internet-facing (L5) and bridges to the plant through the industrial DMZ (L3.5), and the attackers pivoted from it to an internal ESXi host.
- Are you exposed?
Inventory every Check Point Security Gateway, confirm whether Mobile Access is enabled and its patch level, and review gateway logs back to 30 October 2026.
- If you cannot fix it yet
- Limit who can reach the Mobile Access portal and require multi-factor authentication for connections.
- Block SSH from the gateway to ESXi and other plant-side hosts except from approved administration systems.
- Watch for
- PHP webshells on the gateway, and files named DREAM_ANNEXATION.txt on affected hosts.
- SSH sessions from the gateway to ESXi hosts, and use of the DynamicCLI interface.
- ATT&CK for ICS
- T0866Exploitation of Remote ServicesT0809Data Destruction
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: Check Point Research (opens research.checkpoint.com)
More on CVE-2026-123039