# CISA adds Check Point Gaia DynamicCLI LPE (CVE-2026-123039) and UnrealIRCd labeled-response command injection (CVE-2026-114713) to KEV

> CISA added two actively exploited flaws to the KEV catalog on 2026-11-13: CVE-2026-114713, a command injection (CVSS 8.6) in the UnrealIRCd labeled-response module, and CVE-2026-123039, a local privilege escalation (CVSS 7.8) in the Check Point Gaia DynamicCLI daemon. The Check Point flaw was chained after PHP2Shell initial access to deploy webshells, the TSGA backdoor and, against some Israeli victims, the destroy_v6 wiper on VMware ESXi. Attribution is unresolved: tooling overlaps with PhiliKit (previously tied to UNC5221) but the evidence does not fit cleanly.

- **Published:** 2026-11-14T10:27:52Z
- **Last reviewed:** 2026-11-14T10:27:52Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-6068
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-6068.png
- **ID:** TL-2026-6068
- **Severity:** CRITICAL (CVSS 8.6)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 26 (3 shown free below)
- **CVEs:** CVE-2026-114713, CVE-2026-123039, CVE-2026-109618, CVE-2026-109619

## Description

CVE-2026-114713 (UnrealIRCd, CVSS 8.6): the labeled-response module does not escape the IRCv3 'label' message tag. Any user can inject newlines and other characters into server-to-server traffic; because IRC is a text protocol, this executes arbitrary commands with server authority, so an ordinary user can issue IRCOp-level actions such as KILL and GLINE. It affects UnrealIRCd 6.0.0 up to but not including 6.2.7.1; the maintainer says UnrealIRCd 5 (EOL since 2023-07-01) is similarly affected and older EOL branches were not checked. The maintainer released 6.2.7.1 and hot-patch bundle-20261107 on 2026-11-07 and published the advisory on 2026-11-08, calling it the most critical UnrealIRCd issue in 15 years. The maintainer's advisory states the bug was found in an internal AI-assisted audit and reports no in-the-wild exploitation at that time; CISA subsequently listed it in KEV on 2026-11-13, and secondary reporting says exploitation attempts were seen shortly after disclosure. No threat group has been identified for the UnrealIRCd exploitation.

CVE-2026-123039 (Check Point Gaia, CVSS 7.8): the Gaia OS DynamicCLI daemon (dynamic_server) runs as root and listens on a world-writable (0777) Unix socket, /tmp/dynamic_socket, without authenticating callers, allowing local privilege escalation to root. Check Point (SK1000362) says it has observed active exploitation against a couple dozen customers. Affected: Quantum/Force firewalls, Management and Log Servers, Multi-Domain Security Management and Log Server, and Maestro Orchestrator on R82.20, R82.10, R82, R81.20, R81.10 and R81; Spark Firewalls and Smart-1 Cloud are not affected. Fixes ship in Jumbo Hotfix Accumulators (R82.20 Take 14+, R82.10 Take 52+, R82 Take 132+, R81.20 Take 174+); R81.10 and R81 are end-of-support with no fix listed.

Check Point Research reports the exploit chain: (1) initial access against unpatched gateways with the Mobile Access portal using the PHP2Shell flaws (associated with CVE-2026-109618 and CVE-2026-109619; PHP session artifacts under /opt/CPcvpn-R81.20/tmp/ with the marker upload_progress_pwn, and hundreds of Apache/PHP worker segfaults); (2) privilege escalation from the portal service account to root via CVE-2026-123039; (3) PHP webshells (zz<random>.tpl in the login-page template directory, hardcoded key zz2026, command execution, PHP eval and file upload via /tmp/.up.tpl copied to challenge_render.tpl, accepting plain or Base64/XOR-obfuscated input); (4) the TSGA backdoor, staged as /tmp/CPconfigdaemon and relaunched as slot_CPconfigdaemon when root, providing encrypted remote access on TCP 11072 and Unix socket /tmp/.p_sock, PTY shells, script execution, file transfer, configuration theft, backup/snapshot persistence, process injection and binary firewall-log tampering; (5) TSProxy, embedded in TSGA and written to /lib/libcpfwcommon.so, which hooks networking functions in appliance processes to provide selective encrypted SOCKS-style proxying; (6) internal discovery with the gogo scanner; (7) SSH to VMware ESXi hosts using the vpxuser service account; (8) the destroy_v6 Linux wiper, which recursively deletes files (zero-overwriting first unless -f fast mode, with -w exclusions) and drops a Hebrew, politically themed note DREAM_ANNEXATION.txt in each folder.

Campaign waves: exploitation began about a week after a fix was released. Wave 1 (2026-10-30) hit Israeli organizations, with destruction at some victims; wave 2 (2026-11-02) scanned organizations across several countries and sectors with no destruction observed and no clear sector focus. Scanning concentrated between 00:00 and 09:00 UTC. Attribution: TSGA and TSProxy are modified PhiliKit variants (ESET tied PhiliKit to China-nexus UNC5221 in Ivanti attacks), sharing TCP 11072, /tmp/.p_sock, credentials, transport secrets and TLS certificate/key with the PhiliKit libdssafe.so component; infrastructure is on LightNode VPS and gogo has appeared in CISA AA25-022A. However, the destructive activity, Israel focus, Hebrew note and the name 'philistine' do not fit UNC5221's known profile. Check Point did not assess with confidence; scenarios include a single actor, an initial access broker, a false flag, or destruction as a smokescreen. The wiper note uses the Dream Security brand, which recently published PHP2Shell research on China-nexus attacks against Palo Alto devices; this does not establish motive. BeaconBeagle lookups for the listed IPs returned HTTP 502 (no correlation data obtained).

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1505.003 Web Shell
- T1059.004 Unix Shell
- T1059.006 Python
- T1055 Process Injection
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1090 Proxy
- T1573 Encrypted Channel
- T1046 Network Service Discovery
- T1021.004 SSH
- T1078 Valid Accounts
- T1005 Data from Local System
- T1485 Data Destruction

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TSGA Backdoor and TSProxy Staging on Check Point Gaia (CPconfigdaemon / slot_CPconfigdaemon / libcpfwcommon.so)** (`TL-2026-6068-SPL-002`)

Post-exploitation detection for TL-2026-6068: the TSGA backdoor staged as /tmp/CPconfigdaemon (launched with nohup, logging to /tmp/.bd.log) and relaunched as slot_CPconfigdaemon when root, plus TSProxy written to /lib/libcpfwcommon.so for hooking appliance processes. Masquerades as a Check Point component; the /tmp location and the slot_ persistent copy are the behavioural giveaways.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1036, T1059.004, T1055, T1105
- **Data sources:** linux_auditd, sysmon_for_linux, edr_process_events
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=linux sourcetype="linux:audit" (type=EXECVE OR type=PATH OR type=SYSCALL) ("CPconfigdaemon" OR "libcpfwcommon.so" OR "/tmp/.bd.log")
| eval artifact=case(like(_raw,"%slot_CPconfigdaemon%"),"tsga_persistent_slot_copy",like(_raw,"%/tmp/CPconfigdaemon%"),"tsga_staged_in_tmp",like(_raw,"%libcpfwcommon.so%"),"tsproxy_library_write",like(_raw,"%/tmp/.bd.log%"),"tsga_nohup_log",true(),"unclassified")
| where artifact!="unclassified" AND (artifact!="tsproxy_library_write" OR nametype="CREATE")
| stats count min(_time) AS first_seen max(_time) AS last_seen values(exe) AS exe values(name) AS paths values(artifact) AS artifacts BY host
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
union isfuzzy=true
(DeviceFileEvents
 | where Timestamp > ago(24h)
 | where FolderPath =~ "/tmp/CPconfigdaemon" or FileName =~ "slot_CPconfigdaemon" or FolderPath =~ "/tmp/.bd.log" or (FolderPath =~ "/lib/libcpfwcommon.so" and ActionType in ("FileCreated","FileModified")) or SHA256 in~ ("d7549671c7189979f0624ec52dad9ea6a707d23146e3585ab8f8c4720eca0c63", "4171b521fa6441382aa2fa014a08e18ff9a6e0ab6096c9144072bf46b37a2ec8", "fb1a6235eb6bce8c9ec8cd8bb85f17c9c2bde8ecb45b7a243a30ceadf26654da", "ee16e1695711b9d60c62925fcfb2fe1a29c18ae26565bc05410a14e16d2a39d7")
 | project Timestamp, DeviceName, ActionType, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256, Signal="file"),
(DeviceProcessEvents
 | where Timestamp > ago(24h)
 | where FolderPath =~ "/tmp/CPconfigdaemon" or FileName =~ "slot_CPconfigdaemon" or ProcessCommandLine has_any ("CPconfigdaemon", "/tmp/.bd.log") or SHA256 in~ ("d7549671c7189979f0624ec52dad9ea6a707d23146e3585ab8f8c4720eca0c63", "4171b521fa6441382aa2fa014a08e18ff9a6e0ab6096c9144072bf46b37a2ec8", "fb1a6235eb6bce8c9ec8cd8bb85f17c9c2bde8ecb45b7a243a30ceadf26654da", "ee16e1695711b9d60c62925fcfb2fe1a29c18ae26565bc05410a14e16d2a39d7")
 | project Timestamp, DeviceName, ActionType, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine=ProcessCommandLine, SHA256, Signal="process")
```

### Sigma

```yaml
title: TSGA Backdoor Execution from /tmp or slot_CPconfigdaemon on Linux Gateway
id: 2b9c7e14-8a35-4f0d-b6e2-51d3a7c9f002
status: experimental
description: Detects execution of the TSGA backdoor (CPconfigdaemon staged in /tmp, slot_CPconfigdaemon persistent copy, nohup log /tmp/.bd.log) seen on compromised Check Point gateways (TL-2026-6068).
references:
    - https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/
    - https://support.checkpoint.com/results/sk/sk1000362
    - https://seclists.org/oss-sec/2026/q4/576
author: Threadlinqs Team
date: 2026/11/14
tags:
    - attack.defense-evasion
    - attack.t1036
    - attack.execution
    - attack.t1059.004
    - attack.t1055
    - attack.command-and-control
    - attack.t1105
logsource:
    category: process_creation
    product: linux
detection:
    sel_tmp:
        Image: '/tmp/CPconfigdaemon'
    sel_slot:
        Image|endswith: '/slot_CPconfigdaemon'
    sel_log:
        CommandLine|contains: '/tmp/.bd.log'
    sel_hash:
        Hashes|contains:
            - 'SHA256=d7549671c7189979f0624ec52dad9ea6a707d23146e3585ab8f8c4720eca0c63'
            - 'SHA256=4171b521fa6441382aa2fa014a08e18ff9a6e0ab6096c9144072bf46b37a2ec8'
    condition: 1 of sel_*
falsepositives:
    - Unlikely; a genuine Check Point daemon would not run from /tmp
level: critical

```

**Known false positives:**

- Unlikely in production; a legitimate Check Point daemon does not execute from /tmp
- /lib/libcpfwcommon.so may be rewritten by a genuine Check Point hotfix install (verify against a vendor hash)

**Tuning notes:** Scope to Gaia gateways via a host lookup. For libcpfwcommon.so, suppress changes inside approved Jumbo Hotfix windows and compare the SHA256 with the vendor package. Add the hashes to a threat-intel lookup if your auditd feed carries file hashes.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Check Point Gaia DynamicCLI Local Privilege Escalation (CVE-2026-123039) via [indicator] (locked: unlock with TL Creds)
- destroy_v6 Wiper Execution and [indicator] Note on ESXi/Linux (locked: unlock with TL Creds)
- SSH to ESXi as vpxuser from Compromised Gateway and gogo Scanner Execution (locked: unlock with TL Creds)
- UnrealIRCd labeled-response IRCv3 label Tag Injection (CVE-2026-114713) (locked: unlock with TL Creds)
- Web Server or PHP Worker Spawning Shell, Python or Download Tools on Check Point Gateway (locked: unlock with TL Creds)
- TSGA Listener on TCP 11072 and [indicator] Unix Socket Creation (Host-Based C2 Detection) (locked: unlock with TL Creds)
- Check Point Mobile Access PHP2Shell Webshell Template Drop ([indicator] / [indicator] / .up.tpl) (locked: unlock with TL Creds)
- TSGA Encrypted C2 on TCP 11072 and LightNode Attacker IPs ([indicator] / [indicator]) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 26)

Defanged, TLP:CLEAR.

- IP address: `130.94.19[.]204`
- File hash: `edb3e92eb7bda7413a09edcc4b1ba3cbed4bcdf42808a8abce63b6e4c3fda2b3`
- IP address: `130.94.19[.]168`

Full set of 26 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog](https://securityaffairs.com/203040/hacking/u-s-cisa-adds-check-point-and-unrealircd-flaws-to-its-known-exploited-vulnerabilities-catalog.html)
- [Unpatched Check Point gateways are being wiped exploiting PHP2Shell](https://securityaffairs.com/202982/hacking/unpatched-check-point-gateways-are-being-wiped-exploiting-php2shell.html)
- [Check Point Research: PHP2Shell exploitation on Check Point gateway](https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/)
- [Check Point SK1000362: CVE-2026-123039 DynamicCLI local privilege escalation](https://support.checkpoint.com/results/sk/sk1000362)
- [oss-security: UnrealIRCd security advisory for CVE-2026-114713](https://seclists.org/oss-sec/2026/q4/576)
- [OpenCVE: CVE-2026-114713](https://app.opencve.io/cve/CVE-2026-114713)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-6068