I pay attention when CISA puts a flaw on its Known Exploited Vulnerabilities list, because that list is not theory. It means the government has reliable evidence someone is already exploiting it in the wild. On November 13, CISA added two more, and it gave federal agencies until November 16 \u2014 tomorrow \u2014 to fix them. If you run any of this gear, you should treat tomorrow as your deadline too.<\/p>\n\n\n\n
The bigger of the two for most organizations is CVE-2026-123039 in Check Point Security Gateways and Security Management products. CISA lists it at CVSS 7.8. On its own that number undersells it, because of how attackers are actually using it.<\/p>\n\n\n\n
Here is the chain, as Check Point and CISA reporting describe it. Attackers first get in through the gateway’s Mobile Access portal by exploiting the PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619. Then they use CVE-2026-123039 to go to root. That second flaw is in the Gaia OS DynamicCLI daemon, which runs as root and listens on a local, world-writable socket without properly authenticating who connects to it. A low-privilege local user \u2014 or an attacker who just landed through the portal \u2014 can run commands as root and own the box.<\/p>\n\n\n\n
From there it gets worse, fast. Check Point says attackers have deployed webshells and the TSGA backdoor, established persistence, moved laterally into internal networks, and in some cases deployed a wiper called destroy_v6 to erase data on VMware ESXi hosts behind the firewall. The campaign was first seen targeting Israeli organizations on October 30, then a second wave on November 2 hit organizations in multiple countries and sectors. Check Point says fixes were available before the attacks began, which is the part that should sting. This was patchable.<\/p>\n\n\n\n
The second flaw CISA added is CVE-2026-114713 in UnrealIRCd, the open-source IRC server, at CVSS 8.6. It affects versions from 6.0.0 up to, but not including, 6.2.7.1. The bug is in the labeled-response module, which does not properly sanitize the IRCv3 label tag. On a network with at least two linked servers, an ordinary user with no special privileges can inject commands into server-to-server traffic and run them with server-level authority \u2014 disconnecting users, banning people, and taking administrative control of the network. The UnrealIRCd maintainer confirmed attackers were already trying to exploit it shortly after disclosure.<\/p>\n\n\n\n
How bad is this, really? For Check Point shops, bad. Your firewall is supposed to be the door. When the door itself is compromised to root, and the attackers are wiping virtualization hosts behind it, you do not have a patching ticket \u2014 you have a possible incident. For UnrealIRCd, the blast radius is smaller \u2014 most people do not run an IRC network anymore \u2014 but if you do, an unprivileged user taking over your servers is as serious as it gets for that service.<\/p>\n\n\n\n
What to actually do:<\/p>\n\n\n\n
First, patch Check Point now. Install the vendor’s fixed Jumbo Hotfix for your Gaia version, and make sure the earlier PHP2Shell fixes are in too \u2014 patching only the privilege escalation while leaving the portal entry point open is not fixing the chain. If you cannot patch immediately, follow Check Point’s temporary mitigation in its advisory.<\/p>\n\n\n\n
Second, do not assume patching cleans a box that was already hit. Look for the indicators Check Point published: suspicious PHP session files, unexpected webshells or backdoor processes, gaps in your logs, and SSH connections from the gateway to ESXi hosts that should never happen. If you find any of that, isolate the gateway and investigate before you trust it again.<\/p>\n\n\n\n
Third, patch or upgrade UnrealIRCd to 6.2.7.1 or later if you run it, and check whether your network has linked servers exposed to untrusted users.<\/p>\n\n\n\n
Fourth, for everyone else: this is the same lesson I keep coming back to. Internet-facing gear \u2014 firewalls, VPN portals, remote access \u2014 gets patched first, in days, not on the next monthly cycle. Attackers in this campaign moved about a week after a fix was available. That window is the whole game now.<\/p>\n\n\n\n
I run servers for a living, and I would rather spend a Sunday morning patching than a month rebuilding from backups I hope are clean. Check what you are running today, before that deadline passes you by too.<\/p>\n\n\n\n
Sources: CISA Known Exploited Vulnerabilities Catalog (https:\/\/www.cisa.gov\/known-exploited-vulnerabilities-catalog<\/a>) and reporting on the CISA additions and the Check Point attack chain (https:\/\/www.infosectoday.io\/u-s-cisa-adds-check-point-and-unrealircd-flaws-to-its-known-exploited-vulnerabilities-catalog\/<\/a>) and Check Point’s advisory coverage (https:\/\/neotechcloudsolutions.com\/en\/check-point-vulnerability-cve-2026-123039-firewall-esxi\/<\/a>). Always confirm version and hotfix details against Check Point’s own advisory for your exact Gaia release before you apply them.<\/p>\n","protected":false},"excerpt":{"rendered":" I pay attention when CISA puts a flaw on its Known Exploited Vulnerabilities list, because that list is not theory. It means the government has reliable evidence someone is already exploiting it in the wild. On November 13, CISA added two more, and it gave federal agencies until November 16 \u2014 tomorrow \u2014 to fix […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[],"class_list":["post-214","post","type-post","status-publish","format-standard","hentry","category-security"],"_links":{"self":[{"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/posts\/214","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/comments?post=214"}],"version-history":[{"count":1,"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/posts\/214\/revisions"}],"predecessor-version":[{"id":215,"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/posts\/214\/revisions\/215"}],"wp:attachment":[{"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/media?parent=214"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/categories?post=214"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/tags?post=214"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}