CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-114713, a command injection flaw in UnrealIRCd, and CVE-2026-123039, a local privilege escalation flaw in Check Point Security Gateways and Security Management products, to its Known Exploited Vulnerabilities (KEV) catalog. CVSS scores are 8.6 for the UnrealIRCd flaw and 7.8 for the Check Point flaw. The UnrealIRCd maintainer confirmed that attackers were already attempting to exploit the flaw shortly after its disclosure, and no specific threat group has been publicly identified for those attempts.

According to Check Point Research, as reported by Security Affairs, threat actors are actively exploiting CVE-2026-123039 in attacks against unpatched Check Point gateways. Attackers first gain initial access through the Mobile Access portal by exploiting the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), then use CVE-2026-123039 to escalate privileges to root. The campaign initially targeted Israeli organizations on 30 October 2026, and a second wave on 2 November expanded to organizations across multiple countries and sectors. Check Point says the malware shares characteristics with PhiliKit, previously associated with the China-linked UNC5221, but the evidence is insufficient to attribute the whole campaign to that group.

Under Binding Operational Directive (BOD) 22-01, Federal Civilian Executive Branch (FCEB) agencies must address the listed vulnerabilities by the due date, which CISA set as 16 November 2026.

Why it matters Organizations running Check Point gateways or UnrealIRCd servers should check whether they are patched and review their logs for the activity described by Check Point Research, including webshells, the TSGA backdoor and the destroy_v6 wiper on VMware ESXi hosts. The attack chain starts with the PHP2Shell flaws, so patching only the privilege escalation flaw may not close the exposure. Because attribution remains uncertain, defenders should treat the campaign as unresolved rather than tied to a known actor.