[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$frhLggjdNI40gtvPeVjtqfUPBrt_AGfmkO1VOz4_E4ns":3},{"article":4,"iocs":55,"watch_terms":74,"solutions":75,"lesson":170},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"bb8e1b46-923d-4e9b-ac02-93e3d8e3f891","U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog","u-s-cisa-adds-check-point-and-unrealircd-flaws-to-its-known-exploited-vulnerabil-52ee0d","U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Check Point and UnrealIRCd vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: Below are the flaws added to the catalog: CVE-2026-114713 (CVSS score of 8.6) is a high-severity command […]","CISA has added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-114713 in UnrealIRCd and CVE-2026-123039 in Check Point products. The UnrealIRCd flaw allows command injection, while the Check Point vulnerability enables local privilege escalation to root. Both are being actively exploited, with Check Point noting a campaign that uses CVE-2026-123039 to deploy backdoors and wipers, potentially linked to a China-associated threat actor.","CISA adds Check Point and UnrealIRCd flaws to its KEV catalog, with active exploitation reported.","https:\u002F\u002Fsecurityaffairs.com\u002F203040\u002Fhacking\u002Fu-s-cisa-adds-check-point-and-unrealircd-flaws-to-its-known-exploited-vulnerabilities-catalog.html","https:\u002F\u002Fsecurityaffairs.com\u002Fwp-content\u002Fuploads\u002F2020\u002F07\u002FCISA.jpeg","2026-11-14T09:08:00+00:00","2026-11-14T10:00:34.294476+00:00",9,[17,20,22,24,27,29],{"name":18,"type":19},"UnrealIRCd","product",{"name":21,"type":19},"Check Point Security Gateways",{"name":23,"type":19},"Check Point Security Management",{"name":25,"type":26},"IRCv3","technology",{"name":28,"type":26},"Gaia OS",{"name":30,"type":31},"UNC5221","threat_actor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,48,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":49},{"id":32,"icon":34,"name":35,"slug":36},{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60,63,66,68,72],{"type":57,"value":58,"context":59},"cve","CVE-2026-114713","UnrealIRCd command injection vulnerability",{"type":57,"value":61,"context":62},"CVE-2026-123039","Check Point privilege escalation vulnerability",{"type":57,"value":64,"context":65},"CVE-2026-109618","Check Point PHP2Shell vulnerability",{"type":57,"value":67,"context":65},"CVE-2026-109619",{"type":69,"value":70,"context":71},"malware","TSGA backdoor","Deployed in Check Point exploitation campaign",{"type":69,"value":73,"context":71},"destroy_v6 wiper",[18,21,23],{"controls":76,"vendors":163},[77,106,135],{"slug":78,"name":79,"problem":80,"products":81},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[82,90,98],{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":107,"name":108,"problem":109,"products":110},"patch-management","Automated patch management","Known holes get closed in days, not months.",[111,119,127],{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":54,"name":136,"problem":137,"products":138},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[139,147,155],{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":148,"vendor_name":149,"vendor_logo":150,"product_slug":151,"product_name":152,"url":153,"description":154},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":156,"vendor_name":157,"vendor_logo":158,"product_slug":159,"product_name":160,"url":161,"description":162},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",[164],{"slug":165,"name":166,"logo_path":167,"roles":168},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png",[169],"affected",{"slug":171,"title":172,"body":173,"framework_refs":174,"framework_notes":180},"actively-exploited-check-point-and-unrealircd-flaws-highlight-urgency-of-timely-patching","Actively Exploited Check Point and UnrealIRCd Flaws Highlight Urgency of Timely Patching","Two vulnerabilities — a command injection flaw in UnrealIRCd and a local privilege escalation bug in Check Point products — have been added to CISA's KEV catalog after confirmed active exploitation. The Check Point flaw is particularly severe, with a likely China-linked threat actor leveraging it to deploy backdoors and destructive wipers, demonstrating how unpatched systems can become footholds for nation-state campaigns. Organizations that delay applying vendor patches to network security appliances and infrastructure software expose themselves to rapid compromise and potentially catastrophic data destruction. The inclusion in the KEV catalog means U.S. federal agencies are mandated to patch, but all organizations should treat KEV entries as urgent signals regardless of regulatory obligation.",[175,176,177,178,179],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 RS.AN-03: Analysis of notifications","NIS2 Article 21(2)(e)","MITRE ATT&CK T1068: Exploitation for Privilege Escalation",{"NIS2 Article 21(2)(e)":181,"NIST SP 800-53 SI-2: Flaw Remediation":182,"NIST CSF 2.0 RS.AN-03: Analysis of notifications":183,"CIS Control 7: Continuous Vulnerability Management (v8)":184,"MITRE ATT&CK T1068: Exploitation for Privilege Escalation":185},"This provision requires security in acquisition, development, and maintenance including vulnerability handling and disclosure, obligating organizations to have processes for rapidly addressing known exploited vulnerabilities in products like Check Point appliances.","SI-2 requires organizations to identify, report, and correct information system flaws in a timely manner, which directly addresses the failure to patch the Check Point privilege escalation and UnrealIRCd command injection vulnerabilities before they were weaponized.","This category calls for analyzing threat intelligence and vulnerability notifications — such as CISA KEV additions — to inform response actions, which would have accelerated remediation of these flaws once they were publicly flagged as exploited.","This control requires organizations to continuously assess and remediate vulnerabilities; had affected systems been tracked and patched under a continuous vulnerability management program, these actively exploited flaws would have been prioritized before exploitation occurred.","The Check Point CVE is being exploited specifically to escalate local privileges to root, matching this technique, which threat actors then use to establish persistent backdoors and deploy destructive wipers."]