High severity

CISA adds exploited UnrealIRCd flaw CVE-2026-114713 to KEV catalogue alongside Check Point bug

Attackers are already trying a command injection bug in the open-source IRC server, and CISA has told federal agencies to fix it and a Check Point flaw by 16 November.

By Mr Elite, SecurityElites News Desk Published 15 Nov 2026, 10:40 GMT+0530 7 min read

Severity: High
Status: Reported by outlets
Sources: 2
Last checked: 21 seconds ago

The short version

CISA added UnrealIRCd flaw CVE-2026-114713 (CVSS 8.6) and Check Point flaw CVE-2026-123039 (CVSS 7.8) to its KEV catalogue on Friday.
UnrealIRCd versions from 6.0.0 up to, but not including, 6.2.7.1 are affected, according to Security Affairs.
The UnrealIRCd maintainer confirmed exploitation attempts shortly after disclosure; no attacker has been identified.
Check Point Research links its flaw to a campaign that began on 30 October 2026 and included a data-wiping tool.
Federal civilian agencies must fix both flaws by 16 November 2026.

What happened

CISA on Friday 14 November 2026 added two actively exploited flaws, in UnrealIRCd and Check Point products, to its Known Exploited Vulnerabilities (KEV) catalogue, The Hacker News and Security Affairs reported.

KEV is the public list, kept by the US Cybersecurity and Infrastructure Security Agency, of bugs that attackers are known to be using. US federal civilian agencies are required to fix listed flaws by a set date under Binding Operational Directive 22-01, Security Affairs reported. It said experts also advise private organisations to check the list against their own systems.

First on the list is CVE-2026-114713, rated 8.6 on the CVSS severity scale. It is a command injection flaw in UnrealIRCd, an open-source Internet Relay Chat (IRC) server. Security Affairs said it affects versions from 6.0.0 up to, but not including, 6.2.7.1.

Security Affairs reported that the UnrealIRCd maintainer confirmed attackers were trying to exploit the flaw on the internet shortly after it was disclosed. No threat group has been publicly identified, and there is no confirmed link to a particular campaign or financial motive.

The second entry, CVE-2026-123039, rated 7.8, affects Check Point Security Gateways and Security Management products. Security Affairs said it is being used against unpatched gateways. CISA has set 16 November 2026 as the deadline for agencies to fix both.

Why it happened

Security Affairs said the UnrealIRCd flaw sits in the labeled-response module. That module copies an IRCv3 message tag, called the label, into replies from the server without cleaning it first.

An attacker can put newline characters into that label and so smuggle extra commands into traffic between linked servers. On networks with at least two linked servers, even an ordinary user with no special privileges can then run commands with server-level authority, the outlet reported. Examples it gave include disconnecting users or banning them from the network.

For the Check Point bug, Security Affairs said the Gaia OS DynamicCLI daemon runs as root and listens on a local Unix socket at /tmp/dynamic_socket that any user can write to, without properly checking who connects. A low-privileged local attacker can use this to run commands as root.

Neither Security Affairs nor The Hacker News says how the UnrealIRCd bug was found or who reported it. The Hacker News report, as available, gives only the CVE number, score and flaw type.

How this kind of failure works

Both flaws are failures to trust input or callers that should not be trusted. The UnrealIRCd bug is an injection flaw. A program builds a message from data a user supplied, and the receiving side cannot tell where the data ends and the instructions begin.

Picture a restaurant where waiters pass orders to the kitchen on a single line of paper, one order per line. If a customer can dictate their order and the waiter writes it down word for word, a customer who says 'one soup, then a new line, then free dessert for table nine' has just written a second order. The kitchen obeys both because it trusts the paper.

In IRC, linked servers trust each other's messages in much the same way. A newline in the label acts as the line break on the paper, so the receiving server reads the injected text as a genuine command from a peer. The usual fix is to strip or reject control characters such as newlines before data is copied into a protocol message.

The Check Point flaw is a different kind of mistake: a powerful service that accepts requests from anyone who can reach its socket. A root-level daemon that does not check who is talking to it hands root to any local user who can write to that file.

Who is affected

Anyone running UnrealIRCd from 6.0.0 up to but not including 6.2.7.1 is in the affected range, according to Security Affairs. The most exposed are networks with two or more linked servers, because the reported privilege gain relies on server-to-server communication.

To check, run the server's version command or look at the installed package version, and compare it with 6.2.7.1. Review logs for unusual labels or unexpected server-level actions such as mass bans or disconnections.

Check Point customers with Security Gateways or Security Management products that are not patched are at risk. Check Point Research, as cited by Security Affairs, said attackers first got in through the Mobile Access portal using two PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619), then used CVE-2026-123039 to reach root.

How to defend against it

Tick each step as you check it. Your progress is saved on this device.

Upgrade UnrealIRCd to 6.2.7.1 or later. Security Affairs lists 6.2.7.1 as the first version not affected. Patching removes the unsanitised label handling, which is the root of the injection.
Apply Check Point's fixes for CVE-2026-123039. Gateways that are unpatched are being attacked. Install the vendor's updates and also address the Mobile Access portal flaws used for initial entry.
Check your systems against the KEV catalogue. The list is free and names bugs with confirmed exploitation. Comparing it with your asset inventory lets you fix the most urgent items first.
Restrict who can reach IRC and management services. Limit server-link ports to known peers and keep admin portals off the open internet where possible. This shrinks the number of people who can attempt an attack.
Review logs for signs of misuse. On IRC servers, look for odd server-level actions or malformed tags. On Check Point devices, look for unknown webshells or new persistence, since the reported campaign deployed both.
Back up systems and keep copies offline. Check Point Research reported a wiper used against VMware ESXi hosts in some cases. Offline backups mean destructive attacks do not end in permanent data loss.

What to learn from this

The concept: Input sanitisation and trust boundaries

Data that crosses from a user into a system must be treated as data only. If special characters such as newlines keep their meaning inside a message, an attacker can add instructions of their own. This is the general shape of command, SQL and header injection bugs.

The same principle covers privilege boundaries. A root service should verify who is calling it before acting, and it should not expose a socket that any local user can write to.

Both flaws in this story break one of these rules, which is why a low-privileged user can end up with server or root authority.

Never let input or a caller gain authority just by reaching a system; clean the data and check the caller.

Quick check

Why can a newline in the IRCv3 label cause harm in the UnrealIRCd flaw?

Timeline

30 October 2026 Check Point Research says the campaign using CVE-2026-123039 first targeted Israeli organisations, with destructive attacks against some victims.
2 November 2026 A second wave expands to organisations in multiple countries and sectors, according to Security Affairs.
Shortly after disclosure (date not given) The UnrealIRCd maintainer confirms exploitation attempts against CVE-2026-114713.
Friday 14 November 2026 CISA adds CVE-2026-114713 and CVE-2026-123039 to the KEV catalogue.
16 November 2026 Deadline for US federal civilian agencies to fix both flaws.

What is not known yet

Who is carrying out the UnrealIRCd attacks and what they want; no actor has been named.
How many UnrealIRCd servers have been compromised.
Whether the UnrealIRCd attempts are linked to the Check Point campaign; neither The Hacker News nor Security Affairs connects them.
Who is behind the Check Point campaign. Check Point says evidence is insufficient to attribute it confidently to UNC5221, a China-linked actor.

Questions people ask

What is CVE-2026-114713?

It is a high-severity command injection flaw in UnrealIRCd, rated 8.6 on the CVSS scale. It sits in the labeled-response module, which does not sanitise the IRCv3 label tag. Versions from 6.0.0 up to but not including 6.2.7.1 are affected, according to Security Affairs.

Do I need two linked servers to be at risk?

Security Affairs said the described privilege gain, where an ordinary user runs commands with server-level authority, applies on networks with at least two linked servers. Single-server setups may differ, but Security Affairs does not say. Patching is the safe course either way.

What is the KEV catalogue?

It is CISA's list of vulnerabilities known to be exploited in real attacks. Under Binding Operational Directive 22-01, federal civilian agencies must fix listed flaws by a set date. Private organisations are encouraged to use it to prioritise patching.

Is the Check Point flaw linked to the UnrealIRCd flaw?

Neither The Hacker News nor Security Affairs links them. CISA added both on the same day, but they affect different products. Check Point Research ties its flaw to a separate campaign that also used PHP2Shell bugs and the TSGA backdoor.

Sources

The Hacker News: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection
Security Affairs: U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog