CISA KEV Alert: Patch UnrealIRCd CVE-2026-114713 and Check Point CVE-2026-123039

What CISA actually said​

CISA lists the two entries this way:

• CVE-2026-114713: UnrealIRCd, Improper Neutralization of Delimiters.
• CVE-2026-123039: Check Point multiple products, Incorrect Permission Assignment for Critical Resource.

The alert ties the additions to Binding Operational Directive 26-04. That directive covers Federal Civilian Executive Branch agencies. It tells them to fix KEV-listed CVEs first when they are on publicly exposed assets and give an attacker total control after exploitation. It also sets basic expectations for checking whether a system was compromised before it was patched. CISA says the directive binds only federal civilian agencies. It still encourages every organization to adopt risk-based vulnerability management and to prioritize KEV entries.

KEV inclusion means exploitation has been observed somewhere. It does not mean your systems have been hit. It does mean you shouldn't leave the fix in the backlog.

UnrealIRCd CVE-2026-114713: the critical one​

The UnrealIRCd project's own advisory, posted by head coder Syzop on November 7, describes this as a critical flaw. It lets an ordinary user run commands with server or IRC operator authority, which includes actions like KILL and GLINE. The project calls it the most critical issue found in UnrealIRCd in 15 years. The same release fixes nine security issues in total, including crashes, hangs and two IP-address leaks.

The advisory was later updated to say attackers were exploiting the flaw on the internet. A November 8 follow-up says abuse attempts had started. Syzop also says he emailed nearly 1,000 server admins and contacted larger networks directly.

Fix steps the project gives​

1. Apply the spamfilter workaround first. An IRCOp runs a /SPAMFILTER rule that blocks malformed label= tags. The project says one command from one IRCOp protects all linked servers, but only if every server is on 6.0.4 or newer. It says to still apply a full fix afterward.
2. Hot-patch (UnrealIRCd 6.0.0 to 6.2.7). Run ./unrealircd hot-patch bundle-20261107 on each server. The project says this does not work on Windows, so Windows hosts must use the upgrade path. A successful run ends with a message saying the patch was installed and the server rehashed.
3. Or upgrade to 6.2.7.1. On *NIX, run ./unrealircd upgrade and restart. Windows users download the 6.2.7.1 release from the project site.
4. Verify it took. On 6.0.2 and later, run ./unrealircd module-status|grep labeled-response. The advisory describes three outcomes:
   • A version string ending in hot-patch-bundle-20261107 means the hot-patch is installed and the server is safe.
   • A plain 6.2.7.1 means the server runs the fixed release and is also safe.
   • A plain 5.0 means the patch was not applied.
   • IRCOps can also check with MODULE -all, or MODULE -all remote.server.name for remote servers.

End-of-life versions​

UnrealIRCd 5 is affected too, and it has been end-of-life since July 1, 2023. The project's workaround is to add blacklist-module "labeled-response"; to the config on every server and restart. A rehash is not enough. The project says it has not checked other end-of-life versions and warns that they likely carry many of the older bugs. Treat anything older than version 6 as a migration project, not a patching task.

Check Point CVE-2026-123039: a zero-day used in a chain​

This one is a local privilege escalation in Gaia OS, the Linux base of Check Point's firewalls. The DynamicCLI daemon runs as root and listens on a world-writable local socket, /tmp/dynamic_socket, without authenticating connecting processes. The CVSS score is 7.8 (High).

A local-only bug can still matter a lot in practice. Check Point Research describes how it was used in real attacks:

• Starting October 30, 2026, an attacker scanned for and attacked unpatched Check Point Security Gateways, using PHP2Shell on Mobile Access portals for initial access and then CVE-2026-123039.
• The attackers then deployed PHP webshells, the persistent TSGA backdoor and its embedded TSProxy networking component.
• They pivoted from the gateway to a VMware ESXi host over SSH and deployed a wiper.

Check Point said it observed active exploitation against "a couple of dozen customers." The PHP2Shell bugs (CVE-2026-109618 and CVE-2026-109619) are a separate pair of flaws. The privilege escalation is the second step in the chain, not the way in.

Don't read the "local" label as "low risk." If an attacker already has any foothold on the gateway, as in this campaign, this bug turns it into full root control of a security appliance.

Affected versions and fixes​

Check Point's advisory covers Management, Multi-Domain, Log Server and Security Gateway deployments from R80.30 through R82.20. The advisory says Check Point fixed it in the latest Jumbo Hotfix (JHF) for each release. One third-party write-up lists fixed takes as R82.20 Take 14, R82.10 Take 52, R82 Take 132 and R81.20 Take 174 or later. A second outlet confirms Take 132 for R82. I could not verify the other takes against Check Point's own advisory, so confirm them in sk1000362.

If you can't patch right away, Check Point's interim measure is to stop the dynamic_server process and prevent it from restarting. That costs you Dynamic CLI functionality. Check Point says the step-by-step procedure is in sk1000362, so follow that rather than improvising.

Spark firewalls are not affected by this CVE. Check Point's advisory says they are affected by the PHP flaws and need the latest GA version.

Patching reports from admins​

Admins in Check Point's community forum reported rough patch experiences. One said a firewall stopped responding after reinstalling and lost HA. Another said support told them the earlier PHP hotfix does not need to be removed before installing the new JHF. Others asked about AWS AMIs and auto-scaling groups. These are anecdotes, not vendor findings. They do argue for taking a snapshot and patching one HA member at a time.

Why a Windows admin should care​

• Perimeter gear fails open into your domain. A rooted gateway can expose VPN traffic, credentials and the paths to your hypervisors. The reported wiper stage hit VMware ESXi, not Windows, but the pivot logic applies anywhere.
• Your inventory may be incomplete. IRC daemons turn up on dev boxes, community projects and forgotten VMs. Search for them.
• Patch discipline matters more than the severity score. A 7.8 became a destructive-attack enabler once chained with another bug.

Practical checklist​

1. Search asset inventories, scanners and configuration records for UnrealIRCd and Check Point Gaia-based gateways and management servers.
2. For UnrealIRCd, deploy the spamfilter, then hot-patch or upgrade to 6.2.7.1, and verify with the module-status check.
3. For Check Point, install the right JHF for your release, confirm the take number, and use the dynamic_server mitigation only as a stopgap.
4. Treat internet-exposed systems first, as BOD 26-04 would.
5. Where a system was exposed before patching, look for signs of compromise. Don't assume the patch undoes earlier access.
6. Restrict management and console access to trusted networks.

Bottom line​

CISA's catalog adds no new technical facts here. Its value is as a signal. Both vendors' own advisories already described active exploitation, and the Check Point flaw is tied to a reported destructive campaign. If either product is in your environment, check it and patch it now.