Two vulnerabilities affecting Check Point products and UnrealIRCd are now in CISA’s Known Exploited Vulnerabilities (KEV) catalog, following evidence of active exploitation. The agency’s November 13, 2026, alert makes remediation a priority for affected organizations, including Check Point gateway operators facing a reported attack chain that has led to data destruction.
The Check Point vulnerability, CVE-2026-123039, allows an attacker who already has authenticated, low-privilege local access to take control as root. The UnrealIRCd vulnerability, CVE-2026-114713, lets an ordinary IRC user issue commands with server-level authority on networks containing at least two linked servers. Both carry high-severity CVSS ratings; CISA’s evidence of exploitation is the reason for their addition to KEV.
Check Point escalation follows a portal compromise
For Check Point Security Gateways and Security Management products, the vulnerable component is the DynamicCLI daemon in Gaia OS. Security Affairs reports that the daemon operates as root but accepts connections through /tmp/dynamic_socket, a local Unix socket that is world-writable. Inadequate authentication of connecting processes allows a low-privilege local attacker to run arbitrary commands as root. CVE-2026-123039 has a CVSS score of 7.8.
The reported attacks against unpatched gateways combine this escalation with a separate entry point. Citing Check Point Research, Security Affairs describes attackers exploiting the PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, through the Mobile Access portal before using CVE-2026-123039 to obtain root privileges.
After gaining that control, the attackers install webshells and the TSGA backdoor to maintain access, then move into internal networks. Some attacks have also used the destroy_v6 wiper against VMware ESXi hosts to erase data.
Israeli organizations were the campaign’s initial targets on October 30, 2026, and some suffered destructive attacks. A further wave beginning November 2 reached organizations in several countries and sectors.
Security Affairs also relays Check Point’s caution about attribution. Code and infrastructure similarities connect the malware to PhiliKit, a framework previously associated with the China-linked actor UNC5221, but Check Point considers the evidence insufficient to assign the whole campaign to that group. Collaboration between actors and a false-flag operation remain possible explanations.
UnrealIRCd exposes privileged IRC operations
The affected UnrealIRCd range begins at version 6.0.0 and ends before 6.2.7.1. CVE-2026-114713, rated 8.6 on the CVSS scale, concerns the open-source IRC server’s labeled-response module.
The module incorporates an IRCv3 label message tag into server replies without properly sanitizing it. An attacker can use that tag to introduce newline characters and extra commands into traffic exchanged between servers. With at least two servers linked together, a user needs no special privileges to have those commands handled with server-level authority.
That authority could enable administrative control over the IRC network, including disconnecting or banning users, manipulating users and channels, and disrupting service. Security Affairs says the UnrealIRCd maintainer confirmed exploitation attempts on the internet soon after disclosure, with no publicly identified attacker or confirmed connection to a particular campaign or financial motive.
Prioritize remediation and assess compromise
CISA’s alert points federal agencies to Binding Operational Directive 26-04. It requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of KEV-listed vulnerabilities on publicly exposed assets where exploitation grants total control, while deferring lower-risk vulnerabilities. The directive also sets expectations for determining whether an asset was compromised before patching.
Security Affairs reports November 16, 2026, as the remediation deadline for these two flaws. That federal requirement applies to covered agencies, rather than imposing a deadline on every organization.
Administrators responsible for affected Check Point systems and UnrealIRCd networks should prioritize remediation under CISA’s recommendation to all organizations. Covered federal agencies must also apply the directive’s requirements for checking whether attackers gained access before patches were installed.
