On November 13, CISA added two more vulnerabilities to its Known Exploited Vulnerabilities catalog. That catalog matters for one simple reason: CISA does not put a flaw on it because it looks bad on paper. It puts a flaw on it because there is evidence someone is already using it in real attacks.
This time the deadline tells you how serious it is. Federal agencies have until Monday, November 16, to fix both of these. That is a three-day window, not the usual couple of weeks. When I see a deadline that short, I do not treat it as paperwork. I treat it as a sign to check my own systems that same day, even if I am not a federal agency.
The two flaws are very different, and they affect very different people. That is exactly why I am covering both together.
UnrealIRCd: a regular user can act like the server
The first is in UnrealIRCd, the open-source IRC server software a lot of community and gaming networks still run. It is tracked as CVE-2026-114713, with a CVSS score of 8.6. According to the reporting, it affects versions 6.0.0 up to, but not including, 6.2.7.1.
The bug is in the labeled-response module. It does not properly clean up the IRCv3 label tag when it includes that tag in server replies. An attacker can slip in newlines and extra commands, and those commands end up in server-to-server communications. On a network with at least two linked servers, even an ordinary user with no special privileges can end up executing commands with server-level authority. In plain terms, a regular chat user can start acting like the server itself — disconnecting people, banning people, and taking control of how the network runs.
If you run UnrealIRCd, the fix is straightforward: move to 6.2.7.1 or later. Do not wait to see if your small network gets noticed. The maintainer has already confirmed attackers were trying this shortly after disclosure, and automated scanning does not care how big your community is.
Check Point: root on the firewall itself
The second flaw worries me more, because it sits on security equipment itself. CVE-2026-123039, CVSS 7.8, is a local privilege escalation flaw in Check Point Security Gateways and Security Management products. Reporting on Check Point’s advisory says it affects versions R81 through R82.20.
The problem is in the Gaia operating system’s DynamicCLI daemon. It runs as root and listens on a local, world-writable Unix socket without properly checking who is connecting. A local attacker who already has low-level access can connect and run arbitrary commands as root. That is full control of the device.
On its own, “local” might sound like a limit. In the attacks Check Point described, it was not used on its own. According to Check Point Research, as reported by SecurityAffairs, attackers first got in through the Mobile Access portal using separate PHP2Shell vulnerabilities, then used this flaw to climb to root. From there they deployed webshells and a backdoor, moved laterally into internal networks, and in some cases deployed a wiper against VMware ESXi hosts. Check Point said it saw this exploited against a couple of dozen customers. The campaign initially targeted organizations in Israel on October 30, then expanded on November 2 to organizations in multiple countries and sectors. Attribution is still uncertain, and I am not going to pretend otherwise.
That chain is the lesson here. A flaw that only gives you root if you are already on the box sounds contained — until it is paired with a way in from the internet. Then it becomes the step that turns a foothold into ownership of the firewall, and from the firewall into the network behind it.
What to actually do
If you run Check Point, install the November Jumbo Hotfix for your version — reporting lists R82.20 Take 14, R82.10 Take 52, R82 Take 132, and R81.20 Take 174 or later. Then do not stop at patching. Check whether someone got in before the patch: look for unexpected webshells, unknown accounts, and strange outbound connections from the gateway itself. CISA’s current directive explicitly expects agencies to check for compromise before assuming a patch made them clean, and that is good advice for the rest of us too.
What should you do if you run neither of these? Still take two things from this. First, keep an actual inventory of what you run — edge devices, chat servers, the forgotten service on a linked box. You cannot patch what you forgot you had. Second, when CISA gives a three-day deadline, believe the urgency. Patch first, investigate second, and do both this weekend if either product is anywhere in your environment.
Source: CISA, “CISA Adds Two Known Exploited Vulnerabilities to Catalog,” November 13, 2026 — cisa.gov; SecurityAffairs, November 14, 2026 — securityaffairs.com.