CISA adds Check Point and UnrealIRCd flaws to Known Exploited Vulnerabilities catalog

CISA added CVE-2026-114713, a command-injection flaw in the UnrealIRCd internet-relay-chat server, and CVE-2026-123039, a local-privilege-escalation flaw in multiple Check Point products, to its Known Exploited Vulnerabilities catalog, the list of flaws CISA knows are under active exploitation, in an announcement dated Nov. 13, 2026, because attackers are actively exploiting both. |

Federal Civilian Executive Branch agencies must patch both vulnerabilities by Nov. 16, 2026. CISA set that deadline. A CISA binding operational directive requires civilian federal agencies to remediate KEV-listed vulnerabilities by a due date. The catalog announcement gives CVE-2026-123039 the title Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability. |

The directive tells agencies to fix listed vulnerabilities quickly on assets exposed to the internet, because a successful exploit can give an intruder total control over the system. It also governs when agencies have to determine whether hackers breached a system before they apply patches. CISA identifies the requirement as BOD 26-04; Security Affairs points to BOD 22-01 for a comparable requirement. The order applies solely to civilian federal agencies, yet CISA encourages every organization to make fixing listed vulnerabilities a priority. |

CISA plans to keep adding entries to the catalog when a flaw has a CVE ID, proof of exploitation, and clear mitigation steps. Outside experts are pressing private companies to examine the KEV Catalog and patch the listed flaws in their own systems. CISA urges all organizations to prioritize fixing catalog vulnerabilities because the listed flaws are actively exploited, such as CVE-2026-123039 against Check Point gateways. |

Check Point’s flaw exposes network-perimeter devices to full takeover. Rated CVSS 7.8, CVE-2026-123039 is a high-severity local privilege escalation flaw affecting Check Point Security Gateways and Security Management products. A local privilege escalation lets a low-privilege user gain higher-level access. The flaw lives in the Gaia OS DynamicCLI daemon, a background process running as root on a Unix socket at /tmp/dynamic_socket that any local user can write to. |

Since connecting processes are not authenticated, a limited local attacker who has already logged in can run arbitrary commands as root and seize full control of the appliance. Threat actors are actively exploiting the flaw against unpatched Check Point gateways. According to Check Point Research, intruders enter through the Mobile Access portal using the PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619. |

After using CVE-2026-123039 to become root, the intruders plant webshells, web-based shells that give remote control, and the TSGA backdoor, then maintain persistence and move through internal networks. In some cases they run the destroy_v6 wiper, malware that erases disks, on VMware ESXi hosts, a virtualization platform. |

The Check Point campaign first hit Israeli organizations on Oct. 30, 2026, with some victims reporting destructive attacks. A second wave on Nov. 2, 2026, broadened the campaign to groups in many countries and industry sectors. |

Attribution remains uncertain. The intruders’ tools resemble PhiliKit, a framework associated with China-linked UNC5221. Check Point, however, warns that the evidence is not sufficient to confidently blame UNC5221 for the whole campaign. Other explanations are cooperation with a different threat actor or a false-flag operation. |

CVE-2026-114713 rates as a high-severity command injection flaw in the open-source UnrealIRCd internet-relay-chat server, at CVSS 8.6. A command injection lets an attacker insert and execute unintended commands. The flaw affects UnrealIRCd starting at version 6.0.0 and ending before 6.2.7.1. The problem is in the labeled-response module, which handles the IRCv3 label tag incorrectly inside server replies; IRCv3 is a newer version of the internet-relay-chat standard. |

An attacker can slip extra commands and newline characters into traffic moving between linked IRC servers. On a network with at least two linked servers, an ordinary user without special rights can issue commands with server-level authority using CVE-2026-114713. That access could let an attacker kick or ban users, take over IRC network administration, change channels, and interrupt service. |

The project’s maintainer said attackers had been attempting to exploit the flaw online shortly after it was disclosed. No threat group or attacker identity is publicly linked to CVE-2026-114713, and no confirmed evidence ties the exploitation of CVE-2026-114713 to a campaign or financial motive. |

UnrealIRCd version 6.2.7.1 is not affected by CVE-2026-114713 because the flaw covers versions up to but not including that release. CISA urges all organizations to prioritize fixing the catalog-listed vulnerabilities, and it will keep adding entries backed by a CVE ID, evidence of exploitation, and mitigation guidance. |