U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Check Point and UnrealIRCd vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:
Below are the flaws added to the catalog:
- CVE-2026-114713 UnrealIRCd Improper Neutralization of Delimiters Vulnerability
- CVE-2026-123039 Check Point Multiple Products Incorrect Permission Assignment for Critical Resource
CVE-2026-114713 (CVSS score of 8.6) is a high-severity command injection vulnerability in UnrealIRCd, an open-source IRC server software. It affects versions from 6.0.0 up to, but not including, 6.2.7.1.
The flaw is in the labeled-response module, which fails to properly sanitize the IRCv3 label message tag when including it in server replies. An attacker can exploit this weakness to inject newlines and additional commands into server-to-server communications. On networks with at least two linked servers, even an ordinary user with no special privileges can execute commands with server-level authority. This could allow them to perform privileged IRC operations, such as disconnecting users or banning them from the network.
The UnrealIRCd maintainer confirmed that attackers were already attempting to exploit the vulnerability on the internet shortly after its disclosure. However, no specific threat group or attacker identity has been publicly identified, and there is no confirmed evidence linking the attacks to a particular campaign or financial motive. The vulnerability could be abused to gain administrative control over IRC networks, manipulate users and channels, or disrupt IRC services.
CVE-2026-123039 (CVSS score of 7.8) is a high-severity local privilege escalation vulnerability affecting Check Point Security Gateways and Security Management products. The flaw resides in the Gaia OS DynamicCLI daemon, which runs with root privileges and listens on a local, world-writable Unix socket (/tmp/dynamic_socket) without properly authenticating connecting processes. An authenticated local attacker with low privileges can exploit this weakness to execute arbitrary commands as root, gaining full control over the affected device.
Threat actors are actively exploiting the vulnerability in attacks against unpatched Check Point gateways. According to Check Point Research, attackers first gain initial access through the Mobile Access portal by exploiting the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), then leverage CVE-2026-123039 to escalate privileges to root. They subsequently deploy webshells and the TSGA backdoor, establish persistence, move laterally into internal networks, and, in some cases, deploy the destroy_v6 wiper to erase data on VMware ESXi hosts.
The campaign initially targeted Israeli organizations on October 30, 2026, with destructive attacks reported against some victims. A second wave on November 2 expanded to organizations across multiple countries and sectors.
Attribution remains uncertain. The malware shares code and infrastructure characteristics with PhiliKit, a framework previously associated with UNC5221, a China-linked threat actor. However, Check Point cautions that the evidence is insufficient to confidently attribute the entire campaign to this group. Possible explanations include collaboration with another actor or a false-flag operation.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix the two vulnerabilities by November 16, 2026.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
