WORLDTECHCISA lists flaws in Check Point and UnrealIRCd as exploited in real attacks
The U.S. Cybersecurity and Infrastructure Security Agency has placed two high-severity flaws, one in the open-source IRC server UnrealIRCd and one in Check Point security products, on its Known Exploited Vulnerabilities catalog. According to Security Affairs, attempts to exploit the UnrealIRCd flaw were already under way on the internet shortly after it was made public.
Command injection flaw in UnrealIRCd
The first entry, CVE-2026-114713, is a command injection vulnerability in UnrealIRCd, open-source software used to run IRC servers. It carries a CVSS score of 8.6, which places it in the high-severity range. The weakness sits in the labeled-response module, which fails to sanitise the IRCv3 label message tag when that tag is carried into server replies.
An attacker can abuse this to slip newlines and extra commands into traffic exchanged between servers. On a network with at least two linked servers, even an ordinary user holding no special privileges can run commands with server-level authority. Such commands could carry out privileged IRC operations, such as disconnecting users or banning them from the network. The flaw could also be used to seize administrative control of IRC networks, tamper with users and channels, or disrupt IRC services. Versions from 6.0.0 up to, but not including, 6.2.7.1 are affected.
Local privilege escalation in Check Point products
The second entry, CVE-2026-123039, is a local privilege escalation flaw in Check Point Security Gateways and Security Management products, with a CVSS score of 7.8, also rated high. The problem lies in the DynamicCLI daemon of the Gaia operating system. That daemon runs with root privileges and listens on a local, world-writable Unix socket at /tmp/dynamic_socket, but it does not properly authenticate the processes that connect to it.
A local attacker who is authenticated but holds only low privileges can exploit this to execute arbitrary commands as root, and so gain full control of the affected device.
Exploitation attempts and open points
The maintainer of UnrealIRCd has confirmed that attackers were already probing the vulnerability on the internet soon after its disclosure. No specific threat group or attacker has been publicly identified, and there is no confirmed evidence tying the attacks to a particular campaign or financial motive.
The report comes from a single outlet, Security Affairs, which covered the catalog additions.
Open questions
- Which attackers, if any, are behind the exploitation attempts against UnrealIRCd?
- How many UnrealIRCd servers run affected versions and remain unpatched?