News · eGov
The U.S. cybersecurity agency has added two high-severity vulnerabilities affecting Check Point security products and UnrealIRCd server software to its Known Exploited Vulnerabilities catalogue, ordering federal agencies to patch by 16 November 2026.
✦ AI SUMMARY 30-second read
- CVE-2026-114713 in UnrealIRCd allows unprivileged users to execute server-level commands on linked IRC networks.
- CVE-2026-123039 in Check Point's Gaia OS has been weaponised in a multi-stage campaign deploying webshells, a backdoor and a wiper against organisations in multiple countries.
- Federal civilian agencies must remediate both flaws by 16 November 2026 under Binding Operational Directive 22-01.
Why it matters: Active exploitation of both flaws, one enabling root-level takeover of enterprise gateways, raises immediate risk for unpatched organisations worldwide.
This summary was generated by AI. Editors may review and update it.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two high-severity vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue: one affecting UnrealIRCd open-source IRC server software and another affecting Check Point Security Gateways and Security Management products.
Both flaws carry CVSS scores of 7.8 or higher and are confirmed to be under active exploitation. CISA has directed federal civilian executive branch agencies to remediate the vulnerabilities by 16 November 2026, in line with Binding Operational Directive 22-01.
The UnrealIRCd flaw
CVE-2026-114713, with a CVSS score of 8.6, is a command injection vulnerability in UnrealIRCd versions from 6.0.0 up to, but not including, 6.2.7.1. The flaw lies in the labeled-response module, which fails to properly sanitise the IRCv3 label message tag when constructing server replies.
On a network with at least two linked servers, an ordinary user with no special privileges can inject newlines and additional commands into server-to-server communications, effectively executing instructions with server-level authority. This could allow an attacker to disconnect users, issue bans or otherwise manipulate IRC network operations.
The UnrealIRCd maintainer confirmed that exploitation attempts were observed on the internet shortly after the vulnerability was publicly disclosed. No specific threat actor or campaign has been formally identified.
The Check Point privilege escalation flaw
CVE-2026-123039, with a CVSS score of 7.8, is a local privilege escalation vulnerability in the Gaia OS DynamicCLI daemon, which runs with root privileges and listens on a world-writable Unix socket without authenticating connecting processes. An authenticated local attacker with low privileges can exploit this to execute arbitrary commands as root.
Check Point Research has documented a multi-stage attack chain in which threat actors first gain initial access through the Mobile Access portal by exploiting two PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, before leveraging CVE-2026-123039 to escalate to root. Attackers then deploy webshells and the TSGA backdoor, establish persistence, move laterally into internal networks and, in some cases, deploy the destroy_v6 wiper to erase data on VMware ESXi hosts.
The campaign initially targeted Israeli organisations on 30 October 2026, with destructive attacks reported against some victims. A second wave on 2 November 2026 extended the targeting to organisations across multiple countries and sectors.
Attribution and uncertainty
Attribution for the Check Point campaign remains uncertain. The malware shares code and infrastructure characteristics with PhiliKit, a framework previously associated with UNC5221, a China-linked threat actor. Check Point cautions, however, that the available evidence is insufficient to confidently attribute the full campaign to this group, leaving open the possibilities of collaboration with another actor or a false-flag operation.
What organisations should do
Under Binding Operational Directive 22-01, all federal civilian executive branch agencies are required to address the two vulnerabilities by 16 November 2026. CISA also recommends that private organisations review the KEV catalogue and remediate the listed flaws within their own infrastructure.
Elets will update this story as further developments emerge.