CISA adds exploited Check Point and UnrealIRCd flaws to KEV
Original title: U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog
Federal agencies must fix both entries by November 16; Check Point intrusions used PHP2Shell, then a root bug, webshells, and a wiper.
CISA added CVE-2026-114713 in UnrealIRCd and CVE-2026-123039 in Check Point products to the Known Exploited Vulnerabilities catalog. The UnrealIRCd flaw, CVSS 8.6, lets an ordinary user inject commands into server-to-server traffic on linked IRC servers. Check Point Research says attackers exploited Mobile Access PHP2Shell bugs, then CVE-2026-123039, to gain root, deploy webshells and the TSGA backdoor, and in some cases run the destroy_v6 wiper on VMware ESXi. Federal agencies must remediate both by November 16, 2026.
Unconfirmed: Check Point says code overlap with PhiliKit and UNC5221 is not enough to attribute the campaign.
- UnrealIRCd 6.0.0 through versions before 6.2.7.1 is affected.
- CVE-2026-123039 is a CVSS 7.8 local root flaw in Gaia OS DynamicCLI.
- Initial Check Point access used CVE-2026-109618 and CVE-2026-109619.
- The first wave hit Israeli organizations on October 30, 2026.
- A second wave on November 2 reached multiple countries and sectors.
Impact: IRC server-level commands and root on Check Point devices
| Product | Affected | Fixed in |
|---|---|---|
| UnrealIRCd | 6.0.0 up to, but not including, 6.2.7.1 | 6.2.7.1 |
| Check Point Security Gateways and Security Management | — | — |
- 1.Federal agencies must remediate both KEV entries by November 16, 2026.
- 2.Update UnrealIRCd to 6.2.7.1 and patch unpatched Check Point gateways.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1068 Exploitation for Privilege EscalationT1505.003 Web ShellT1485 Data Destruction
- Vendors
- Check Point
- Threat actors
- UNC5221
- Malware
- TSGAdestroy_v6PhiliKit
- Organizations
- CISA
- Countries
- Israel
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-114713 | Label tag injection in UnrealIRCd before 6.2.7.1 | 8.6 | <1% | KEVPoC ×2 | KEV |
| CVE-2026-123039 | Local root command execution via Gaia OS DynamicCLI socket | 7.8 | 1% | KEV | KEV |
From the original article
2 min read at securityaffairs.com
U. S. Cybersecurity and Infrastructure Security Agency (CISA) adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.