The Cybersecurity and Infrastructure Security Agency has expanded its Known Exploited Vulnerabilities catalog by adding two security flaws affecting Check Point systems and UnrealIRCd. The inclusion signals that threat actors are actively leveraging these weaknesses in real-world attacks, posing immediate risks to enterprise networks and federal infrastructure.

According to an advisory published by CISA Advisories, both flaws represent significant attack vectors frequently targeted by malicious actors. Federal civilian agencies are required to assess their systems and mitigate the risks in accordance with federal directives, while private-sector security teams are strongly encouraged to align their patch management priorities accordingly.

What Happened

CISA updated its catalog on November 13, 2026, listing two specific vulnerabilities confirmed to be under active exploitation:

  • CVE-2026-123039: An incorrect permission assignment vulnerability affecting multiple Check Point products.
  • CVE-2026-114713: An improper neutralization of special elements or delimiters vulnerability residing in the UnrealIRCd server software.

The agency monitors active exploitation across diverse environments and cataloged these two entries after verifying evidence of weaponization. Under federal guidelines, items added to the catalog meet strict criteria, including a validated CVE identifier, documented evidence of exploitation in the wild, and clear mitigation or patching steps from the respective vendors.

Technical Details and Risk Factors

The Check Point flaw, tracked as CVE-2026-123039, involves an improper permission assignment for critical resources across multiple vendor product lines. In security appliances and enterprise networking platforms, incorrect permission handling often enables unauthorized actors to modify critical configurations, elevate local privileges, or access restricted functionality on the underlying system.

The second flaw, CVE-2026-114713, impacts UnrealIRCd, a widely used open-source Internet Relay Chat server daemon. The issue stems from the improper neutralization of delimiters within inputs. When delimiter characters are insufficiently filtered or escaped, applications may misinterpret boundaries in command strings or data streams, potentially leading to command injection, parameter manipulation, or unexpected administrative execution.

Impact and Federal Directives

Under Binding Operational Directive (BOD) 26-04, titled "Prioritizing Security Updates Based on Risk," Federal Civilian Executive Branch (FCEB) agencies are subject to specific vulnerability management rules. The directive requires federal organizations to prioritize rapid remediation of high-risk vulnerabilities listed in the KEV catalog, particularly when these flaws reside on publicly exposed assets and grant total control of the target post-exploitation.

BOD 26-04 also authorizes agencies to defer remediation for lower-risk issues while focusing resources on internet-facing entry points. Furthermore, the directive sets explicit operational requirements for federal agencies to investigate whether an adversary compromised their systems before updates or patches were installed.

While BOD 26-04 mandates compliance exclusively for federal civilian bodies, CISA noted that all enterprise defenders should adopt a risk-based approach and accelerate the remediation of known exploited vulnerabilities across their perimeters.

What You Should Do

System administrators and security teams managing Check Point installations or UnrealIRCd instances should take immediate remediation steps:

  • Identify exposed assets: Scan external perimeters to determine whether any Check Point management interfaces, gateways, or UnrealIRCd servers are accessible from the public internet.
  • Apply vendor mitigations: Consult official support channels for Check Point and UnrealIRCd to obtain and deploy the latest security releases or configuration workarounds addressing CVE-2026-123039 and CVE-2026-114713.
  • Conduct compromise assessments: Check historical network traffic and device audit logs to verify whether unauthorized administrative actions, unusual privilege elevations, or unexpected outbound connections occurred prior to applying updates.
  • Report uncataloged threats: Organizations that identify active exploitation of other vulnerabilities can submit evidence through CISA's official KEV Nomination Form, provided the reports include valid CVE identifiers, proof of exploitation, and actionable mitigation guidance.