U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog

Two vulnerabilities — a command injection flaw in UnrealIRCd and a local privilege escalation bug in Check Point products — have been added to CISA's KEV catalog after confirmed active exploitation. The Check Point flaw is particularly severe, with a likely China-linked threat actor leveraging it to deploy backdoors and destructive wipers, demonstrating how unpatched systems can become footholds for nation-state campaigns. Organizations that delay applying vendor patches to network security appliances and infrastructure software expose themselves to rapid compromise and potentially catastrophic data destruction. The inclusion in the KEV catalog means U.S. federal agencies are mandated to patch, but all organizations should treat KEV entries as urgent signals regardless of regulatory obligation.