CISA adds exploited UnrealIRCd and Check Point flaws to KEV
Original title: CISA Adds Two Known Exploited Vulnerabilities to Catalog
The alert names CVE-2026-114713 and CVE-2026-123039 but gives no affected versions, fixes, or exploit details.
CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-114713 in UnrealIRCd, an improper neutralization of delimiters flaw, and CVE-2026-123039 affecting Check Point multiple products, an incorrect permission assignment for a critical resource. Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of high-risk KEV entries on publicly exposed assets and to check for compromise before patching. CISA urges other organizations to prioritize KEV remediation; the alert does not list versions or fixes.
Unconfirmed: Affected versions, fixed releases, and how the flaws are exploited are not stated.
- CVE-2026-114713 is an UnrealIRCd improper neutralization of delimiters flaw.
- CVE-2026-123039 is a Check Point multiple-products permission-assignment flaw.
- BOD 26-04 applies only to Federal Civilian Executive Branch agencies.
- KEV nominations need a CVE ID, exploitation evidence, and clear mitigation guidance.
Impact: Known exploitation; specific attacker gains are not described
| Product | Affected |
|---|---|
| UnrealIRCd | — |
| Check Point | — |
- 1.Prioritize remediation of CVE-2026-114713 and CVE-2026-123039 as KEV entries.
- 2.FCEB agencies should follow BOD 26-04, including pre-patch compromise checks.
- Vendors
- Check Point
- Organizations
- CISA
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-114713 | Label tag injection in UnrealIRCd before 6.2.7.1 | 8.6 | <1% | KEVPoC ×2 | KEV |
| CVE-2026-123039 | Local root command execution via Gaia OS DynamicCLI socket | 7.8 | 1% | KEV | KEV |
From the original article
1 min read at cisa.govCISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.