As reported by SecurityAffairs, CISA has added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog — one affecting UnrealIRCd and the other impacting Check Point Security Gateways. Both are being exploited in the wild, making immediate patching a compliance and operational priority for any organization subject to BOD 22-01 or similar mandates.

Security Impact: As reported by SecurityAffairs, CISA has added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog — one affecting UnrealIRCd and the other impacting Check Point Security Gateways.

Vulnerability Details

CVEProductCVSSSeverityExploited?
CVE-2026-114713UnrealIRCd 6.0.0 – 6.2.7.1 (excl.)8.6HighYes — post-disclosure attempts observed
CVE-2026-123039Check Point Security Gateways / Security Management (Gaia OS)7.8HighYes — active exploitation confirmed

CVE-2026-114713 — UnrealIRCd Command Injection

The labeled-response module in UnrealIRCd fails to sanitize the IRCv3 label message tag when constructing server replies. On multi-server IRC networks, any authenticated user — regardless of privilege level — can inject newlines and additional commands into server-to-server traffic. This grants server-level authority: disconnecting users, issuing network bans, or manipulating channels. The maintainer confirmed exploitation attempts began shortly after public disclosure.

Patch: Upgrade to UnrealIRCd 6.2.7.1 or later.

CVE-2026-123039 — Check Point Local Privilege Escalation

The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable Unix socket (/tmp/dynamic_socket) without authenticating connecting processes. Any local user can send commands that execute with root privileges. However, the real danger lies in the documented attack chain: threat actors first gain remote initial access through the Mobile Access portal by exploiting PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), then escalate to root via this LPE — achieving full device compromise.

Patch: Apply the latest Check Point Hotfix for your Gaia OS version. Disable or restrict Mobile Access portal exposure where not required.

Why This Matters

The UnrealIRCd flaw is significant because it inverts the trust model of IRCv3 server federation — a single low-privilege user on one server can influence operations across an entire linked network. While IRC may seem legacy, it remains widely used in developer communities, support infrastructure, and some operational environments. Network operators who assumed server-to-server traffic was trustworthy need to rethink that assumption entirely.

The Check Point vulnerability is the more pressing concern for enterprise defenders. The combination of remote code execution via the Mobile Access portal followed by root-level LPE represents a complete takeover chain on perimeter security devices — exactly the infrastructure that should be the hardest to compromise. Attackers controlling a security gateway can intercept traffic, modify inspection policies, establish persistence, and pivot laterally into the internal network while evading the very controls designed to detect them.

When your firewall becomes the attacker's foothold, every layer of defense behind it inherits that risk.

Who Is Most at Risk

Why This Matters
Check Point customers: Any organization running Security Gateways or Security Management with Gaia OS and an exposed Mobile Access portal — especially SMBs and remote-access-heavy deployments where the portal is internet-facing.
IRC network operators: Multi-server UnrealIRCd deployments, particularly public networks where user trust is low and attackers can register accounts freely.
Federal agencies and contractors: BOD 22-01 requires remediation of KEV-listed vulnerabilities within the prescribed timeframe — these additions reset the clock.

Shield53 Recommendations

Immediate Actions

  • Check Point: Inventory all gateways and management appliances running Gaia OS. Apply vendor hotfixes immediately. If patching is delayed, disable the Mobile Access portal or restrict it via network ACLs to trusted source IPs only. Audit for indicators of compromise: unexpected /tmp/dynamic_socket connections, new local users, modified Gaia configuration, or unusual processes spawned by DynamicCLI.
  • UnrealIRCd: Upgrade all linked servers to 6.2.7.1+. A single unpatched server on a federated network can be leveraged to attack the entire topology. Temporarily disable the labeled-response module if upgrade is not immediately possible.
  • Detection: Monitor for anomalous server-to-server IRC traffic patterns. On Check Point appliances, enable Gaia OS audit logging and alert on any root-level process execution originating from the DynamicCLI socket.
  • Hygiene: Review all internet-exposed management interfaces and remote access portals. The PHP2Shell → LPE chain demonstrates why perimeter device exposure minimization is critical — every exposed service is a potential initial access vector.

Both vulnerabilities are now on the KEV catalog, meaning the exploitation window is effectively closed for any defender paying attention — but the attackers have already moved first. Treat these as active incidents, not routine patch cycles.