CISA ADDS TWO ACTIVELY EXPLOITED VULNERABILITIES TO KEV CATALOG

THREAT SUMMARY

Category: Known Exploited Vulnerabilities / Network Security / Access Control / Enterprise Security
Affected Product(s): UnrealIRCd; Check Point Multiple Products
CVE(s): CVE-2026-114713; CVE-2026-123039
Primary Risks: Improper neutralization of delimiters and incorrect permission assignment affecting critical resources
Threat Status: Active exploitation confirmed by CISA
Affected Environment(s): Systems operating affected UnrealIRCd and Check Point products
Attack Vector(s): Not specified in the CISA alert
CVSS: Not listed in the CISA alert
CWE: Not listed in the CISA alert
CISA Action: Added both vulnerabilities to the Known Exploited Vulnerabilities Catalog on November 13, 2026
Required Response: Federal Civilian Executive Branch agencies must prioritize remediation in accordance with Binding Operational Directive 26-04. CISA encourages all organizations to prioritize remediation of KEV-listed vulnerabilities.

---

The Cybersecurity and Infrastructure Security Agency added two vulnerabilities affecting UnrealIRCd and multiple Check Point products to its Known Exploited Vulnerabilities Catalog on November 13, 2026, based on evidence of active exploitation.

The additions are CVE-2026-114713, an UnrealIRCd improper neutralization of delimiters vulnerability, and CVE-2026-123039, a Check Point incorrect permission assignment for critical resource vulnerability affecting multiple products.

CISA identifies vulnerabilities of these types as frequent attack vectors for malicious cyber actors and warns that they pose significant risks to the federal enterprise. Their placement in the KEV Catalog confirms that both vulnerabilities are being exploited in real-world activity and require elevated remediation priority.

---

Vulnerability Details

CVE-2026-114713 — UnrealIRCd Improper Neutralization of Delimiters Vulnerability

CVE-2026-114713 affects UnrealIRCd and is identified by CISA as an Improper Neutralization of Delimiters Vulnerability.

Delimiter-handling weaknesses can create security conditions in which specially crafted input is not processed according to intended boundaries or syntax. In affected software, improper handling of those delimiters can interfere with how data or commands are interpreted.

CISA added CVE-2026-114713 to the KEV Catalog after confirming evidence of active exploitation.

Organizations operating affected UnrealIRCd environments should identify vulnerable deployments, review applicable vendor remediation guidance, apply required updates or mitigations, and examine exposed systems for suspicious activity that may have occurred before remediation.

---

CVE-2026-123039 — Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability

CVE-2026-123039 affects multiple Check Point products and is identified by CISA as an Incorrect Permission Assignment for Critical Resource Vulnerability.

Permission assignments define which users, processes, or services are authorized to interact with protected resources. Incorrect permissions on critical resources can create unauthorized access paths or provide privileges beyond those intended by system administrators.

CISA’s addition of CVE-2026-123039 to the KEV Catalog confirms active exploitation and establishes the vulnerability as an immediate remediation priority for affected Check Point environments.

Organizations using affected Check Point products should identify exposed systems, apply applicable vendor remediation, verify security permissions and configuration controls, and review relevant administrative and security activity for indicators of unauthorized access.

---

Affected Products and Environments

The November 13 additions affect two different areas of network and enterprise infrastructure:

• UnrealIRCd
• Check Point multiple products

UnrealIRCd is associated with Internet Relay Chat server infrastructure, while Check Point products are deployed across enterprise security environments.

Organizations should ensure that asset inventories account for affected systems across production networks, externally exposed infrastructure, branch locations, secondary environments, legacy systems, and other deployments that may operate outside centralized patch-management workflows.

Priority should be placed on systems exposed to untrusted networks, externally reachable services, critical security infrastructure, and platforms controlling access to sensitive enterprise resources.

---

Operational Impact

The two vulnerabilities present different security conditions but share the most important operational characteristic: CISA has confirmed active exploitation.

CVE-2026-114713 involves improper neutralization of delimiters within UnrealIRCd. CVE-2026-123039 involves incorrect permission assignment for critical resources across affected Check Point products.

Both conditions can weaken established security boundaries when present in vulnerable systems.

For organizations, KEV status elevates the urgency of assessing exposed infrastructure and understanding the potential operational consequences of exploitation. Security teams must evaluate whether affected installations support essential communications, security enforcement, or access to critical resources, where unauthorized activity could extend beyond the initially vulnerable system.

Systems performing security, communications, access-control, or externally exposed functions should receive particular attention because compromise in those environments can affect broader organizational operations.

---

Why KEV Status Matters

CISA’s Known Exploited Vulnerabilities Catalog identifies vulnerabilities with confirmed real-world exploitation.

Potential KEV additions must have:

• An assigned CVE identifier
• Evidence of exploitation
• Clear mitigation guidance

Both November 13 additions satisfy CISA’s KEV inclusion criteria, establishing documented exploitation as the basis for their elevated vulnerability-management priority.

For defenders, their KEV status means:

• Active exploitation has been confirmed
• Affected systems require elevated remediation priority
• Externally exposed assets should receive immediate review
• Security teams should identify systems that remained vulnerable before remediation
• Compromise assessment should be conducted where exposure warrants it
• Applicable vendor updates and mitigations should be implemented without unnecessary delay
• Remediation should be validated across the full environment

---

Federal Response

Binding Operational Directive 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability-management requirements for Federal Civilian Executive Branch agencies.

The directive reinforces the importance of CISA’s KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically KEV-listed CVEs affecting publicly exposed assets that grant total control of an asset after exploitation.

BOD 26-04 also establishes baseline expectations for determining when federal agencies must assess whether threat actors compromised vulnerable systems before remediation was applied.

The directive applies to FCEB agencies, while CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of vulnerabilities included in the KEV Catalog.

The November 13 additions therefore provide an immediate operational signal to federal agencies and private-sector organizations managing affected UnrealIRCd and Check Point systems.

---

Defensive Guidance

Organizations should identify affected deployments and follow applicable vendor remediation guidance.

• Inventory UnrealIRCd installations across organizational infrastructure.
• Identify Check Point products potentially affected by CVE-2026-123039.
• Prioritize publicly exposed and externally accessible systems.
• Apply applicable security updates, mitigations, or configuration changes.
• Validate remediation after deployment.
• Review permissions associated with critical resources on affected Check Point systems.
• Examine administrative activity for unauthorized changes.
• Review application, system, authentication, and network logs for suspicious activity.
• Inspect externally exposed UnrealIRCd systems for unexplained behavior or configuration changes.
• Review privileged access associated with affected security infrastructure.
• Preserve relevant evidence if compromise is suspected.
• Examine connected systems when unauthorized access is identified.
• Verify that remote, branch, secondary, and legacy deployments are included in remediation efforts.
• Continue monitoring applicable CISA and vendor security guidance.

Asset identification remains essential. A vulnerable system that is absent from an organization’s inventory can remain exposed after primary remediation efforts are considered complete.

---

Compromise Assessment

Applying an update or mitigation addresses the vulnerable condition, but organizations should also determine whether affected systems were accessed while exposure remained.

Because CISA has confirmed active exploitation of both vulnerabilities, security teams should review systems that were vulnerable before remediation for evidence of compromise.

Defenders should examine available telemetry for:

• Unexpected administrative access
• Unauthorized configuration changes
• Unrecognized account or permission modifications
• Suspicious process or command activity
• Unexpected network connections
• Changes involving critical resources
• Unusual activity on externally exposed services
• New or altered accounts
• Security-control modifications
• Unexpected privilege assignments
• Evidence of lateral movement
• Activity inconsistent with established administrative operations

If suspicious activity is identified, organizations should preserve forensic evidence, isolate affected systems where appropriate, revoke unauthorized access, rotate exposed credentials, review adjacent systems, and determine whether attackers established additional access elsewhere in the environment.

---

30-Day Outlook

The addition of CVE-2026-114713 and CVE-2026-123039 to the KEV Catalog places both vulnerabilities under heightened defensive attention.

Organizations operating UnrealIRCd or affected Check Point products should focus on completing asset discovery, applying applicable remediation, validating corrective action, and examining systems that remained exposed before fixes were implemented.

Particular attention should be directed toward internet-facing systems and security infrastructure because overlooked deployments can remain accessible after primary remediation efforts have concluded.

During the next 30 days, organizations should evaluate remediation progress, identify unresolved exposure across secondary and legacy environments, and determine whether additional investigation is necessary for systems that remained vulnerable during documented exploitation activity.

---

TRJ Verdict

CISA’s November 13 action confirms that CVE-2026-114713 and CVE-2026-123039 are actively exploited vulnerabilities affecting UnrealIRCd and multiple Check Point products.

The vulnerabilities involve different security weaknesses, but both affect boundaries that organizations depend on to maintain control over systems and critical resources.

Their inclusion in the KEV Catalog places responsibility on affected organizations to address verified exposure before compromised systems threaten broader network security.

Organizations should identify affected deployments, apply applicable remediation, validate security configurations, and review systems that remained exposed during the active exploitation period.

Federal agencies must respond according to BOD 26-04, while organizations outside the federal enterprise should treat CISA’s KEV designation as a direct warning that these vulnerabilities are already being used by malicious cyber actors.

Active exploitation changes the priority. Remediation closes the vulnerability, and compromise assessment determines whether the system was reached before that protection was in place.

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---