Ethical Hacking News
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two new flaws to its Known Exploited Vulnerabilities (KEV) catalog, indicating that these vulnerabilities have been identified as significant threats to national security and are being actively exploited by threat actors. The two added flaws are CVE-2026-114713 and CVE-2026-123039, which affect Check Point and UnrealIRCd, respectively. This is a timely reminder of the importance of staying up-to-date with the latest security patches and vulnerability fixes, and of the need for proactive measures to protect against emerging threats.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two new flaws to its Known Exploited Vulnerabilities (KEV) catalog, indicating significant threats to national security. CVE-2026-114713 is a high-severity command injection vulnerability in UnrealIRCd, and CVE-2026-123039 is a high-severity local privilege escalation vulnerability in Check Point Security Gateways. Attackers have been actively exploiting these vulnerabilities to gain administrative control, manipulate users, and disrupt IRC services. The campaign initially targeted Israeli organizations, but later expanded to organizations across multiple countries and sectors. CISA has ordered federal agencies to fix the vulnerabilities by November 16, 2026, and experts recommend private organizations review the catalog and address the vulnerabilities.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently added two new flaws to its Known Exploited Vulnerabilities (KEV) catalog, indicating that these vulnerabilities have been identified as significant threats to national security and are being actively exploited by threat actors. The two added flaws are CVE-2026-114713 and CVE-2026-123039, which affect Check Point and UnrealIRCd, respectively.
CVE-2026-114713 is a high-severity command injection vulnerability in UnrealIRCd, an open-source IRC server software. This vulnerability was identified in version 6.0.0 up to, but not including, 6.2.7.1, and is caused by the labeled-response module failing to properly sanitize the IRCv3 label message tag when including it in server replies. This allows an attacker to inject newlines and additional commands into server-to-server communications, potentially leading to privileged IRC operations, such as disconnecting users or banning them from the network. According to Check Point Research, attackers were already attempting to exploit this vulnerability on the internet shortly after its disclosure, and have been using it to gain administrative control over IRC networks, manipulate users and channels, or disrupt IRC services.
CVE-2026-123039, on the other hand, is a high-severity local privilege escalation vulnerability affecting Check Point Security Gateways and Security Management products. The flaw resides in the Gaia OS DynamicCLI daemon, which runs with root privileges and listens on a local, world-writable Unix socket (/tmp/dynamic_socket) without properly authenticating connecting processes. An authenticated local attacker with low privileges can exploit this weakness to execute arbitrary commands as root, gaining full control over the affected device. Check Point Research reports that threat actors are actively exploiting this vulnerability in attacks against unpatched Check Point gateways, and that they first gain initial access through the Mobile Access portal by exploiting the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), then leverage CVE-2026-123039 to escalate privileges to root.
The campaign initially targeted Israeli organizations on October 30, 2026, with destructive attacks reported against some victims. A second wave on November 2 expanded to organizations across multiple countries and sectors. Attribution remains uncertain, and the malware shares code and infrastructure characteristics with PhiliKit, a framework previously associated with UNC5221, a China-linked threat actor. However, Check Point cautions that the evidence is insufficient to confidently attribute the entire campaign to this group. Possible explanations include collaboration with another actor or a false-flag operation.
In light of these new additions to the KEV catalog, CISA has ordered federal agencies to fix the two vulnerabilities by November 16, 2026. Experts also recommend that private organizations review the catalog and address the vulnerabilities in their infrastructure. This is a timely reminder of the importance of staying up-to-date with the latest security patches and vulnerability fixes, and of the need for proactive measures to protect against emerging threats.
Related Information:
https://www.ethicalhackingnews.com/articles/US-CISA-Adds-Check-Point-and-UnrealIRCd-Flaws-to-its-Known-Exploited-Vulnerabilities-Catalog-ehn.shtml
https://securityaffairs.com/203040/hacking/u-s-cisa-adds-check-point-and-unrealircd-flaws-to-its-known-exploited-vulnerabilities-catalog.html
https://nvd.nist.gov/vuln/detail/CVE-2026-114713
https://www.cvedetails.com/cve/CVE-2026-114713/
https://nvd.nist.gov/vuln/detail/CVE-2026-123039
https://www.cvedetails.com/cve/CVE-2026-123039/
https://nvd.nist.gov/vuln/detail/CVE-2026-109618
https://www.cvedetails.com/cve/CVE-2026-109618/
https://nvd.nist.gov/vuln/detail/CVE-2026-109619
https://www.cvedetails.com/cve/CVE-2026-109619/
Published: Sat Nov 14 03:42:00 2026 by llama3.2 3B Q4_K_M
