Check Point: does gateway recovery reach internal hosts?
Recovering the edge requires following the paths it can reach. Separate patch delivery, investigation and acceptance of each restored service.
Leggi in portogheseBy Pentesty
The report and its limits
On November 12, Check Point described PHP2Shell followed by CVE-2026-123039, gateway persistence and access to ESXi. The October 30 wave included destruction; the November 2 wave showed no such evidence. Attribution and motive remain uncertain.
The case supports an operational question: who follows access from the edge into another service’s administration? An organization needs its own inventory and records to answer. Reporting about another environment can inform investigation priorities, but does not establish compromise of every appliance carrying the same product name or justify a conclusion about a specific local deployment.
Map dependencies before changing access
Choose a gateway and list the internal services it needs to reach for its approved purpose. Identify the owners of those connections and the accounts involved. Ask them to validate the list together. A dependency without an owner belongs in the pending-work register, with a deadline for establishing its purpose before that path is restored.
Build a timeline from evidence available within the organization. Connect approved changes, alerts, administrative access and observed interruptions. State the interval covered by each record source. When collection began after the period being investigated, preserve that limitation: an absence of events in that dataset does not describe the period that collection never covered.
Give patching and trust separate acceptance decisions
The network team should record the approved artifact, the appliance receiving it and evidence of execution following maintenance. In parallel, the response owner assesses whether findings require a wider investigation. Agree in advance who can release the service and what information that decision-maker needs from each participating team before accepting the resulting operational state.
Review the purpose of administrative paths with their owners. Plan credential replacement where it is part of the approved response, and track the consumers depending on those credentials. A service failing after rotation may expose a forgotten dependency. Investigate its purpose before restoring broad permissions simply to accelerate recovery or bypass an unresolved ownership decision.
Exercise recovery using controlled data
In a representative laboratory or formally authorized maintenance window, choose one legitimate task and one action that should remain prohibited. Use synthetic accounts and test services. Record the initiating identity, destination receiving the attempt and observed decision. This connects service availability with the particular access behavior actually assessed, giving the acceptance decision an explicit and repeatable scope.
Include the virtualization owner when accepting paths reaching that layer. Request evidence of the approved state and check a business operation selected with the service owner. If restoration is included, preserve the criteria used to choose the recovery point and the checks performed afterwards. Do not execute destructive tools to demonstrate that a proposed recovery exercise works.
Deliver a decision that can be revisited
The final report should distinguish examined appliances, reviewed administrative paths and services actually tested. Assign each pending item to a person and a review condition. Management can then decide on gradual restoration without interpreting a single maintenance task as closure of every response activity. Keep the acceptance decision connected to the particular environment represented by its evidence.
Preserve the procedure, sample and expected outcomes so the assessment can be repeated after material changes. A new provider, administrative route or identity change may require another test. Evidence is useful when another team can understand what was checked, when it was checked and which limits remain, without having to reconstruct undocumented assumptions from the original incident discussion.
KEV: record priority and triage evidence
Editorial update: November 14, 2026
On November 13, CISA added CVE-2026-123039 to KEV and referenced BOD 26-04. The catalog entry records a November 16 due date and forensic triage. The cited directive covers US Federal Civilian Executive Branch agencies; CISA encourages other organizations to prioritize risk.
For the company, this update can open a triage task linked to its gateway inventory and the dependencies the gateway can reach. Before planned maintenance, agree with response owners which records can be preserved, who will perform authorized collection and which decisions depend on that evidence. Record time coverage and limitations. Any conclusion about compromise should remain tied to observations from the environment actually examined.
At acceptance, connect the identifier of the applied update, the examined appliance and the result of the legitimate operation tested. Give each open triage item an owner and a review condition. If the team lacks records covering the investigated period, declare that gap. The decision to restore a service should identify the sample and dependencies that were actually checked.
Frequently asked questions
Does updating the gateway finish the investigation?
Record the update as its own deliverable and retain the investigation decision with the response owner. Conclusions depend on evidence and coverage in the environment being assessed.
Must the attack be reproduced?
The proposed procedure uses legitimate operations and actions that should be denied, with synthetic accounts. It does not require malware execution or destructive activity.
Who should accept restoration?
Agree on network, identity, virtualization and business owners beforehand. Each should receive relevant observations and state the pending work within their responsibility.
How should a logging gap be recorded?
State the source and available coverage interval. Explain which decisions remain open and who will assess additional sources to reduce uncertainty.
Sources and references
Original Pentesty analysis, published November 13, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.