Act today Critical Known exploited Patch available CVSS up to 8.6 (NVD)
CISA lists new Check Point flaw as exploited, plus an UnrealIRCd flaw
CISA Cybersecurity AdvisoriesCheck Point, UnrealIRCdCVE-2026-114713, CVE-2026-123039
What happened. CISA added CVE-2026-123039, a Check Point multiple-products permissions flaw, and CVE-2026-114713, an UnrealIRCd flaw, to its Known Exploited Vulnerabilities Catalog. It cites evidence of active exploitation for both.
Who is affected. Users of Check Point products and UnrealIRCd. Industrial sites using a Check Point gateway for remote access are exposed, because vendors and engineers often reach plant systems through it.
What to do. Check whether you run Check Point products or UnrealIRCd, then apply the vendor patch, starting with anything reachable from the internet.
When to act. Act today: Sites running Check Point gateways: check exposure and patch today, as these flaws are exploited.
Editor's reading
Forasset ownerOT security leadIT security
- Purdue level
- L5
- L4
- L3.5
Why: A Check Point gateway sits at the boundary or industrial DMZ (L3.5) and faces the internet (L5), while UnrealIRCd is a chat server usually found in enterprise IT (L4).
- Are you exposed?
Search your asset inventory for Check Point gateways and UnrealIRCd servers, and check which are reachable from the internet or used for vendor remote access.
- If you cannot fix it yet
- Limit who can connect through the Check Point gateway and require multi-factor authentication on the remote-access path.
- Keep unpatched gateways off the plant network until the fix is applied.
- Restrict UnrealIRCd to hosts that need it and block it from the internet.
- Watch for
- Review Check Point gateway logs for unexpected administrative changes, permission changes or logons from unfamiliar addresses.
- Look for new connections from the gateway into the industrial DMZ or plant networks.
- ATT&CK for ICS
- T0819Exploit Public-Facing Application
Inferred from the facts above, not stated by the source. Check it against your own site before acting.