On November 13, 2026, CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, confirming that threat actors are actively weaponizing them in the wild. The additions target two very different but equally dangerous attack surfaces: UnrealIRCd, a widely deployed open-source Internet Relay Chat daemon, and multiple Check Point security products, which sit at the network perimeter of thousands of enterprises.
These are not theoretical risks. Inclusion in the KEV Catalog means CISA has verified evidence of active exploitation. For Federal Civilian Executive Branch (FCEB) agencies, Binding Operational Directive (BOD) 26-04 mandates rapid remediation on a defined timeline. For the private sector, the KEV listing is the clearest possible signal: patch now, or assume you are being targeted.
This post breaks down both vulnerabilities, provides detection content for SOC teams, and delivers actionable remediation guidance grounded in 15+ years of incident response experience.
Technical Analysis
CVE-2026-114713 — UnrealIRCd Improper Neutralization of Delimiters Vulnerability
Affected Product: UnrealIRCd — one of the most widely deployed open-source IRC server daemons, commonly found on Linux/Unix systems. It is used by organizations running internal chat infrastructure, gaming communities, and embedded into some managed platforms.
Vulnerability Class: Improper Neutralization of Delimiters (CWE-140). This class of vulnerability occurs when the application fails to properly sanitize or escape delimiter characters in user-supplied input, allowing an attacker to inject malicious content that breaks out of the intended data context. In the context of an IRC daemon, delimiters separate commands, parameters, and message boundaries. Failure to neutralize them can enable command injection, protocol manipulation, or unauthorized command execution on the underlying server.
How Exploitation Works (Defender's Perspective): An attacker sends specially crafted input containing delimiter characters that the UnrealIRCd server fails to properly parse. This can allow the attacker to inject additional IRC protocol commands, manipulate server-side operations, or in some cases achieve remote code execution if the injected content reaches a shell or system call. Because UnrealIRCd often runs with elevated privileges or as a dedicated service account, successful exploitation can provide a foothold for lateral movement.
Exploitation Status: Confirmed active exploitation — CISA KEV listed as of November 13, 2026.
CVE-2026-123039 — Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability
Affected Products: Multiple Check Point products. Check Point's product line includes next-generation firewalls (NGFW), VPN gateways, endpoint security agents, and management consoles. These products are perimeter security devices — they are the front door to enterprise networks.
Vulnerability Class: Incorrect Permission Assignment for Critical Resource (CWE-732). This occurs when a critical system resource — a file, directory, configuration object, or service — is assigned permissions that are too permissive, allowing unauthorized actors to read, modify, or execute it.
How Exploitation Works (Defender's Perspective): An attacker with low-privileged access (or in some scenarios, unauthenticated network access) can exploit the incorrect permission assignment to access or modify a critical resource. In Check Point products, this could mean reading sensitive configuration files containing VPN credentials, modifying firewall policies, writing arbitrary files to privileged directories, or escalating privileges to gain full administrative control of the gateway. Given that Check Point devices terminate VPN tunnels and enforce network segmentation, compromise of these devices is a catastrophic event — it provides an attacker with network-level access to everything behind the firewall.
Exploitation Status: Confirmed active exploitation — CISA KEV listed as of November 13, 2026.
Why This Combination Is Dangerous
The pairing of an IRC daemon vulnerability and a perimeter security device vulnerability is notable. Threat actors targeting Check Point devices gain network-level access. Threat actors targeting UnrealIRCd gain a foothold on internal Linux servers. Both provide initial access vectors that can be chained with privilege escalation and lateral movement techniques to achieve full domain compromise.
Detection & Response
SIGMA Rules
The following Sigma rules target observable behaviors associated with exploitation of these vulnerabilities. The UnrealIRCd rule focuses on suspicious child process spawning from the IRC daemon process — a hallmark of post-exploitation activity. The Check Point rules target unauthorized file access and configuration modification patterns.
---
title: UnrealIRCd Suspicious Child Process Execution
id: a1b2c3d4-1147-4e13-9abc-def012345678
status: experimental
description: Detects suspicious child processes spawned by the UnrealIRCd daemon (ircd), which may indicate post-exploitation activity following CVE-2026-114713 exploitation. UnrealIRCd should not normally spawn shell interpreters, network utilities, or system binaries.
references:
- https://www.cisa.gov/news-events/alerts/2026/11/13/cisa-adds-two-known-exploited-vulnerabilities-catalog
- https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/11/13
tags:
- attack.execution
- attack.t1059
- attack.t1059.004
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentCommandLine|contains:
- 'ircd'
- 'unrealircd'
selection_child:
CommandLine|contains:
- '/bin/bash'
- '/bin/sh'
- '/bin/dash'
- 'wget'
- 'curl'
- 'nc '
- 'ncat'
- 'python'
- 'perl'
- 'base64'
- 'chmod'
- 'chown'
- 'iptables'
- 'useradd'
- 'crontab'
condition: selection_parent and selection_child
falsepositives:
- Legitimate IRC server administration scripts
- Monitoring agents that interact with the IRC daemon
level: high
---
title: UnrealIRCd Configuration or Binary Modification
id: b2c3d4e5-1147-4f13-abcd-ef0123456789
status: experimental
description: Detects modification of UnrealIRCd configuration files or binary replacement, which may indicate persistence establishment following CVE-2026-114713 exploitation.
references:
- https://www.cisa.gov/news-events/alerts/2026/11/13/cisa-adds-two-known-exploited-vulnerabilities-catalog
- https://attack.mitre.org/techniques/T1554/
author: Security Arsenal
date: 2026/11/13
tags:
- attack.persistence
- attack.t1554
- attack.defense_evasion
logsource:
category: file_event
product: linux
detection:
selection:
TargetFilename|contains:
- '/unrealircd/conf/'
- '/ircd/unrealircd.conf'
- '/ircd/ircd.conf'
- '/unrealircd/src/ircd'
- '/home/ircd/'
TargetFilename|endswith:
- '.conf'
- 'ircd'
condition: selection
falsepositives:
- Legitimate configuration updates by system administrators
- Package manager updates to UnrealIRCd
level: medium
---
title: Check Point Gateway Suspicious Process or Configuration Access
id: c3d4e5f6-1230-4039-bcde-f01234567890
status: experimental
description: Detects suspicious process execution or unauthorized access to critical Check Point configuration files, which may indicate exploitation of CVE-2026-123039 (Incorrect Permission Assignment for Critical Resource). Monitors for non-standard processes accessing Check Point configuration directories and policy files.
references:
- https://www.cisa.gov/news-events/alerts/2026/11/13/cisa-adds-two-known-exploited-vulnerabilities-catalog
- https://attack.mitre.org/techniques/T1078/
- https://attack.mitre.org/techniques/T1005/
author: Security Arsenal
date: 2026/11/13
tags:
- attack.credential_access
- attack.t1005
- attack.t1078
- attack.privilege_escalation
logsource:
category: process_creation
product: linux
detection:
selection_paths:
CommandLine|contains:
- '/opt/CPsuite'
- '/opt/CPshrd'
- '$FWDIR/conf/'
- '$FWDIR/database/'
- 'fw config'
- 'cpconfig'
- 'fwm '
- 'cat /etc/fw.conf'
- '/var/log/fw'
selection_suspicious_procs:
CommandLine|contains:
- 'cat '
- 'cp '
- 'mv '
- 'chmod '
- 'chown '
- 'base64'
- 'openssl enc'
- 'tar '
- 'gzip'
- 'curl'
- 'wget'
- 'nc '
- 'scp '
condition: selection_paths and selection_suspicious_procs
falsepositives:
- Legitimate Check Point administration via Gaia OS
- Automated backup scripts
- SmartConsole policy pushes
level: high
KQL — Microsoft Sentinel / Defender
The following KQL queries are designed for Microsoft Sentinel environments ingesting Syslog and CEF data from Linux servers (UnrealIRCd) and Check Point devices. Even if your Check Point logs flow through a SIEM connector, these queries target the observable behaviors.
Hunt Query 1 — UnrealIRCd Post-Exploitation Process Execution (Syslog via Sentinel):
// Hunt for suspicious child processes spawned by UnrealIRCd daemon
// Targets post-exploitation behavior following CVE-2026-114713
Syslog
| where TimeGenerated > ago(7d)
| where ProcessName in~ ("ircd", "unrealircd", "ircu")
or SyslogMessage has_any ("ircd", "unrealircd")
| where SyslogMessage has_any (
"/bin/bash", "/bin/sh", "wget", "curl", "nc ", "ncat",
"python", "perl", "base64", "chmod", "useradd", "crontab",
"/tmp/", "/dev/shm/", "iptables"
)
| project TimeGenerated, Computer, ProcessName, SyslogMessage, SeverityLevel
| order by TimeGenerated desc
Hunt Query 2 — Check Point Configuration Access and File Modification (CEF/Syslog):
// Hunt for unauthorized access to Check Point critical resources
// Targets CVE-2026-123039 — Incorrect Permission Assignment for Critical Resource
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DeviceVendor =~ "Check Point"
| where Activity has_any (
"config", "policy", "permission", "file_access",
"fw config", "cpconfig", "fwm"
)
| where Message has_any (
"permission denied", "unauthorized", "access granted",
"configuration changed", "policy installed",
"$FWDIR", "/opt/CPsuite", "fw.conf"
)
| project TimeGenerated, SourceIP, DestinationIP, Activity, Message, DeviceProduct, DeviceAction
| order by TimeGenerated desc
Hunt Query 3 — Cross-Reference: New Network Connections from IRC or Check Point Processes:
// Correlate network connections originating from UnrealIRCd or Check Point processes
// Look for unexpected outbound connections that may indicate C2 communication
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has_any ("ircd", "unrealircd")
| where SyslogMessage has_any ("connect", "connection", "ESTABLISHED")
| extend ParsedIP = extract(@"(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})", 1, SyslogMessage)
| where isnotempty(ParsedIP)
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by Computer, ParsedIP
| order by ConnectionCount desc
Velociraptor VQL
The following VQL artifact hunts for evidence of UnrealIRCd compromise on Linux endpoints. It checks for suspicious processes, modified configuration files, and unexpected network connections from the IRC daemon.
-- Hunt for UnrealIRCd post-exploitation indicators (CVE-2026-114713)
-- Checks for suspicious child processes, config modifications, and network connections
-- Section 1: Suspicious child processes of ircd
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(bash|sh|wget|curl|nc |ncat|python|perl|base64|chmod|useradd|crontab|/tmp/|/dev/shm/)'
AND Name =~ '(ircd|unrealircd|ircu)'
-- Section 2: UnrealIRCd configuration file modification times
SELECT FullPath, Size, Mtime, Atime, Ctime, Mode
FROM glob(globs=['/home/*/unrealircd/conf/*.conf', '/etc/unrealircd/*.conf', '/opt/unrealircd/conf/*.conf', '/etc/ircd/*.conf'])
WHERE Mtime > now() - 604800
-- Section 3: Network connections from ircd processes
SELECT Pid, Name, RemoteIP, RemotePort, Status
FROM netstat()
WHERE Name =~ '(ircd|unrealircd)'
AND RemotePort NOT IN (6667, 6668, 6669, 6697, 7000)
Remediation & Verification Script
The following Bash script helps administrators verify UnrealIRCd installation status, check for indicators of compromise, and apply hardening measures. For Check Point, use the Gaia CLI commands included in the script to verify configuration integrity.
#!/bin/bash
# CVE-2026-114713 (UnrealIRCd) and CVE-2026-123039 (Check Point) Verification & Hardening Script
# Run as root or with sudo
echo "=========================================="
echo " Security Arsenal — KEV Remediation Script"
echo " CVE-2026-114713 (UnrealIRCd)"
echo " CVE-2026-123039 (Check Point)"
echo " Date: $(date)"
echo "=========================================="
# --- SECTION 1: UnrealIRCd Detection & Verification ---
echo ""
echo "[+] Checking for UnrealIRCd installation..."
# Check if UnrealIRCd is installed
IRCD_PATHS=("/home/ircd" "/opt/unrealircd" "/etc/unrealircd" "/usr/local/unrealircd")
IRCD_FOUND=false
for path in "${IRCD_PATHS[@]}"; do
if [ -d "$path" ]; then
echo "[!] UnrealIRCd found at: $path"
IRCD_FOUND=true
fi
done
# Check for running ircd processes
IRCD_PROCS=$(ps aux | grep -E '(ircd|unrealircd)' | grep -v grep)
if [ -n "$IRCD_PROCS" ]; then
echo "[!] UnrealIRCd process detected:"
echo "$IRCD_PROCS"
IRCD_FOUND=true
fi
if [ "$IRCD_FOUND" = true ]; then
echo ""
echo "[+] Checking UnrealIRCd version..."
# Attempt to get version
if command -v unrealircd &> /dev/null; then
unrealircd --version 2>/dev/null || echo "[!] Could not determine version via command"
fi
echo ""
echo "[+] Checking for suspicious child processes of ircd..."
IRCD_PID=$(pgrep -f 'ircd|unrealircd' | head -1)
if [ -n "$IRCD_PID" ]; then
echo "[*] IRCD PID: $IRCD_PID"
echo "[*] Child processes:"
ps --ppid "$IRCD_PID" -o pid,ppid,user,cmd 2>/dev/null || echo "[*] No child processes found"
fi
echo ""
echo "[+] Checking for recently modified UnrealIRCd config files..."
find /home /opt /etc /usr/local -name "*.conf" -path "*ircd*" -mtime -7 -ls 2>/dev/null
find /home /opt /etc /usr/local -name "unrealircd.conf" -mtime -7 -ls 2>/dev/null
echo ""
echo "[+] Checking for suspicious files in /tmp and /dev/shm..."
find /tmp /dev/shm -user ircd -ls 2>/dev/null
find /tmp /dev/shm -name "*.sh" -o -name "*.py" -o -name "*.elf" 2>/dev/null | head -20
echo ""
echo "[!] ACTION REQUIRED: Update UnrealIRCd to the latest patched version immediately."
echo "[!] Check https://www.unrealircd.org/ for the latest security release."
echo "[!] If UnrealIRCd is not business-critical, consider disabling the service:"
echo " systemctl stop unrealircd && systemctl disable unrealircd"
else
echo "[+] No UnrealIRCd installation detected on this system."
fi
# --- SECTION 2: Check Point Verification ---
echo ""
echo "=========================================="
echo "[+] Check Point Verification (run on Check Point Gaia OS)"
echo "=========================================="
echo ""
echo "[*] If this is a Check Point device, run the following commands in Gaia clish:"
echo ""
echo " # Check current software version"
echo " show version all"
echo ""
echo " # Check for available updates"
echo " show installer status"
eecho ""
echo " # Review recent configuration changes"
echo " show configuration changes"
eecho ""
echo " # Check file permissions on critical directories"
echo " ls -la \$FWDIR/conf/"
echo " ls -la \$FWDIR/database/"
echo " ls -la /opt/CPsuite*/fw1/conf/"
eecho ""
echo " # Review recent logins"
echo " show users"
echo " last -20"
eecho ""
echo " # Check for unauthorized cron jobs"
echo " crontab -l"
echo " ls -la /etc/cron.d/"
echo ""
echo "[!] ACTION REQUIRED: Apply the latest Check Point hotfix immediately."
echo "[!] Refer to Check Point Support Center for CVE-2026-123039 patch details."
echo "[!] Restrict management interface access to trusted networks only."
# --- SECTION 3: Network IOC Check ---
echo ""
echo "=========================================="
echo "[+] Checking for suspicious outbound connections..."
echo "=========================================="
# Check for connections from ircd to non-standard ports
if [ -n "$IRCD_PID" ]; then
echo "[*] Network connections from ircd process:"
ss -tlnp | grep "$IRCD_PID" 2>/dev/null || netstat -tlnp 2>/dev/null | grep "$IRCD_PID"
echo ""
echo "[*] All connections from ircd:"
lsof -i -P -n | grep ircd 2>/dev/null || echo "[*] lsof not available or no connections found"
fi
echo ""
echo "=========================================="
echo " Script complete. Review all findings above."
echo " Report suspicious activity to your SOC/IR team."
echo "=========================================="
Remediation
CVE-2026-114713 — UnrealIRCd
- Patch immediately. Check the UnrealIRCd official website for the latest security release addressing CVE-2026-114713. If a patch is available, apply it now — do not wait for a maintenance window.
- If patching is not immediately possible, consider temporarily disabling the UnrealIRCd service or restricting network access to the IRC daemon to trusted internal IPs only using host-based firewall rules (
iptablesornftables). - Audit existing installations. Run the Bash script above to check for signs of compromise — suspicious child processes, modified configuration files, and unexpected network connections.
- Review service account privileges. Ensure the UnrealIRCd daemon runs under a dedicated, low-privilege service account with no sudo access and no access to sensitive system files.
- Implement network segmentation. IRC daemons should not be reachable from the internet unless absolutely required. Place them behind a firewall with strict ingress/egress rules.
CVE-2026-123039 — Check Point Multiple Products
- Apply Check Point's security fix immediately. Log in to the Check Point Support Center and search for CVE-2026-123039 to identify the specific hotfix or Jumbo Hotfix Accumulator that addresses this vulnerability for your product version.
- Restrict management interface access. Ensure the Check Point management interface (SmartConsole, Gaia web UI, SSH) is accessible only from dedicated management networks. Never expose management interfaces to the internet.
- Audit file permissions. Verify that critical configuration files and directories (
$FWDIR/conf/,$FWDIR/database/) have correct ownership and permissions. Look for world-readable or world-writable files that should be restricted. - Review recent configuration changes. Check audit logs for unauthorized policy changes, new administrator accounts, or unexpected configuration modifications.
- Monitor for C2 indicators. Check Point devices that have been compromised may exhibit unexpected outbound connections. Review firewall logs for connections to unfamiliar external IPs.
BOD 26-04 Compliance Deadline
Under Binding Operational Directive 26-04, FCEB agencies must remediate KEV-listed vulnerabilities within the timeframe specified in the directive. Check the CISA KEV Catalog for the specific due date assigned to these CVEs. Non-compliance is reportable. For private-sector organizations, treat the KEV due date as your own internal SLA — it represents CISA's assessment of the maximum acceptable exposure window.
Key Takeaways for Security Teams
- KEV listing = active exploitation. There is no ambiguity. If you run UnrealIRCd or Check Point products, you are a potential target right now.
- Perimeter devices are high-value targets. Check Point firewalls and VPN gateways are exactly the kind of devices nation-state actors and ransomware groups prioritize. Compromise of a perimeter device bypasses your entire network security stack.
- Do not overlook open-source infrastructure. UnrealIRCd may seem like a low-priority application, but any internet-facing service running on your network is an attack surface. Threat actors routinely chain exploitation of low-profile services to gain initial access before moving laterally.
- Detection is not optional. Even after patching, assume compromise may have already occurred. Run the detection content provided in this post. Hunt for the behavioral indicators — suspicious child processes, configuration modifications, and unexpected network connections.
- BOD 26-04 reinforces risk-based prioritization. The directive exists because the volume of vulnerabilities exceeds any organization's capacity to patch everything. KEV-listed vulnerabilities are the top of the stack. If you are not already using the KEV Catalog as your primary patch prioritization input, start today.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.