Two Exploited Flaws in UnrealIRCd and Check Point Land on KEV List

En bref

• CVE-2026-114713 and CVE-2026-123039 affect UnrealIRCd and Check Point products.
• Threat actors are exploiting both flaws in the wild.
• The KEV listing covers federal agencies and signals broader public-sector risk.
• Successful exploitation can yield full control of affected assets.
• Patch prioritization and fast remediation are required.

On 2026-11-13, two security defects—CVE-2026-114713 and CVE-2026-123039—were placed in the Known Exploited Vulnerabilities catalog. The affected software is UnrealIRCd and Check Point products. The listing follows evidence that actors with malicious intent are already using the flaws, not merely conducting proof-of-concept research.

The scope is narrow but serious: two vulnerabilities, with federal agencies named as the population facing the immediate remediation requirement. Because the KEV process applies to federal enterprises, the listing creates compliance pressure and raises the risk profile for any organization running the same exposed products. Public-sector defenders outside the federal mandate should still treat the notice as a prioritization signal.

Impact is severe. Exploitation can result in total asset control, meaning an intruder could seize full command of a compromised system rather than merely read data. That elevates both likelihood and consequence for internet-facing services and for systems that support critical operations.

Context matters: KEV addition is a call to accelerate security update prioritization. Teams should treat deployment as urgent, especially where UnrealIRCd or Check Point gear sits on the network perimeter or supports essential services. Delayed patching leaves a known exploited path open to adversaries.

What to watch: vendor advisories, exploitation attempts in logs, and whether additional products are implicated. For K-12 and government defenders, the same logic applies even where the federal requirement does not. Rapid remediation now is safer than waiting for incident response later.

À faire maintenant

1. Inventory every UnrealIRCd and Check Point deployment, including internet-facing and remote-access instances; record versions and owners.
2. Apply vendor security updates for CVE-2026-114713 and CVE-2026-123039 immediately, prioritizing exposed systems and federal KEV requirements.
3. If patching cannot be completed at once, isolate affected services behind access controls and remove unnecessary internet exposure.
4. Hunt for signs of exploitation in logs and configurations; treat full administrative control as a possible compromise outcome.
5. Rotate credentials and review trust relationships for any system that may have been exposed.
6. Track vendor advisories and KEV updates; validate remediation with a post-patch scan.
7. Report confirmed incidents through established government and sector channels.

Références CVE

• CVE-2026-114713
• CVE-2026-123039

Source originale

CISA Advisories