CISA adds actively exploited flaws in UnrealIRCd and Check Point Gaia OS to its KEV catalog, with a Monday deadline

The US Cybersecurity and Infrastructure Security Agency (CISA) added two already-exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on Friday, November 13, 2026: CVE-2026-114713 in the UnrealIRCd IRC server and CVE-2026-123039 in several Check Point products. For both, the remediation deadline is Monday, November 16, three days after listing.

The deadline binds the non-military federal agencies of the US executive branch (Federal Civilian Executive Branch, FCEB), under CISA’s BOD 26-04 directive on prioritising security updates by risk. For both entries the catalog also asks for an initial forensic triage, that is, an examination of systems for signs of compromise. Use in ransomware attacks is recorded as unknown.

Check Point Gaia OS: root through a world-writable socket

CVE-2026-123039 affects Check Point’s Gaia OS. The DynamicCLI background service (dynamic_server), which serves dynamic command-line commands, runs with root privileges and listens on a local socket (/tmp/dynamic_socket) that is writable by everyone (permissions 0777), without checking which process connects. An authenticated local user can therefore send a single command to the socket and execute it as root. It is a local privilege escalation, which presupposes that the attacker can already run code on the appliance. The CVSS score is 7.8, and the company observed active exploitation against about two dozen of its customers.

Check Point lists as affected the Force firewalls, management and logging servers, Multi-Domain Security Management and the Maestro Orchestrator, in versions R82.20, R82.10, R82, R81.20, R81.10 and R81. Spark firewalls and Smart-1 Cloud are not affected. The fix is included in the Jumbo Hotfix Accumulator bundles: from Take 14 for R82.20, Take 52 for R82.10, Take 132 for R82 and Take 174 for R81.20. After installation the socket should show permissions 0660 (root, config). As a temporary measure, Check Point suggests stopping the dynamic_server process with the commands dbset process:dynamic_server and dbset :save, which makes Dynamic CLI commands stop working.

UnrealIRCd: command injection between servers

CVE-2026-114713 affects UnrealIRCd, an open-source IRC (Internet Relay Chat, a real-time chat service) server that, according to the project’s website, has a 38% market share. The flaw is in the labeled-response module of versions 6.0.0 through 6.2.7: the IRCv3 “label” message tag is not properly escaped when it is repeated in replies. Any user on a network with two or more connected servers can thus inject commands into server-to-server traffic, which are executed with the server’s privileges.

Bram Matthys (Syzop), who signs the project’s announcements, called the problem critical and said it is the most serious found in UnrealIRCd in 15 years. A simple user can disconnect others (KILL) or impose global access bans (GLINE). The problems were found in an internal review of the project. Version 6.2.7.1, released on Saturday, November 7, fixes nine security issues, among them crashes, freezes and leaks of users’ IP addresses.

On most networks running UnrealIRCd 6, the fix can be applied without a restart, with the command ./unrealircd hot-patch bundle-20261107 on each server (versions 6.0.0 to 6.2.7). Alternatively, upgrading to 6.2.7.1 is done with ./unrealircd upgrade and a restart. UnrealIRCd 5, which reached the end of its support cycle on July 1, 2023, is also affected and needs a configuration change and a restart.