CISA Adds CVE-2026-114713 and CVE-2026-123039 to Known Exploited Vulnerabilities Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog after confirming active exploitation in the wild. The entries include CVE-2026-114713 affecting UnrealIRCd and CVE-2026-123039 impacting multiple Check Point products. These vulnerabilities are described as frequent attack vectors that can grant attackers full control of compromised assets. Federal Civilian Executive Branch agencies must follow BOD 26-04 requirements to prioritize remediation of KEV-listed issues on publicly exposed systems. The directive also requires agencies to verify whether threat actors have already compromised systems before applying patches. CISA encourages all organizations to adopt similar risk-based vulnerability management practices and provides a nomination form for submitting additional exploited vulnerabilities.

CISA AlertsNovember 13, 2026Translated from English

Read at source

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

The newly added entries are CVE-2026-114713 affecting UnrealIRCd and described as an Improper Neutralization of Delimiters Vulnerability, along with CVE-2026-123039 impacting multiple Check Point products and classified as an Incorrect Permission Assignment for Critical Resource Vulnerability.

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.

Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities.

BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities.

CISA will continue to add vulnerabilities to the catalog that meet the specified criteria. Organizations aware of an exploited vulnerability not currently listed in the KEV Catalog may submit it for potential addition through CISA’s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.

Check Point BOD 26-04 CVE-2026-123039 CVE-2026-114713 UnrealIRCd

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Vulns & Exploits

Vulns & Exploits

PostgreSQL Patches 52 Flaws Including 22-Year-Old Bug Enabling Authenticated RCE

The PostgreSQL Global Development Group has released updates addressing 52 security vulnerabilities, one of which is a type confusion flaw dating back to 2004 that allows authenticated remote code execution. Tracked as CVE-2026-6460 with a CVSS score of 8.8, the issue affects composite types and can be exploited by users with object creation privileges. Researcher Mehmet Ince published a working exploit that involves preparing queries, altering field types, and triggering memory operations leading to code execution. All versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25 are impacted, and administrators must also rebuild C-language extensions. Additional fixes cover client tools such as pg_restore and psql, while one unauthenticated flaw can restart PostgreSQL 18 servers. No in-the-wild exploitation has been observed according to CISA and project assessments.

The Hacker NewsNov 13, 2026Translated from English

Vulns & Exploits

Check Point Security Gateways Compromised via PHP2Shell Exploits to Deploy VMware ESXi Data Wiper

Vulnerable Check Point Security Gateway instances were targeted in PHP2Shell attacks that deployed data-wiping malware on VMware ESXi hosts. The campaign began on October 30 against Israeli organizations and later expanded to multiple countries. Attackers exploited two critical PHP vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 for unauthenticated remote code execution, then chained them with a zero-day tracked as CVE-2026-123039 for root access. They installed PHP webshells and the TSGA backdoor with TSProxy networking component before moving laterally to ESXi hosts using the gogo scanner. In the final stage, the destroy_v6 wiper was deployed to recursively delete data with optional zero-fill overwriting. Political messages referencing Dream Security Ltd. were left on some systems, raising false-flag concerns. Check Point linked elements to the PhiliKit framework associated with UNC5221 but could not confirm attribution.

BleepingComputerNov 13, 2026Translated from English

Vulns & Exploits

Mior and Skyfall Attacks Expose AMD SEV-SNP VMs Allowing Rogue Hosts to Steal Secrets and Modify Memory

Two new attacks named Mior and Skyfall were disclosed this week that enable a malicious hypervisor to bypass AMD SEV-SNP protections on virtual machines. Mior, developed by researchers at ETH Zurich, corrupts the Reverse Map Table during VM startup by redirecting PSP writes through a controlled PCIe device, ultimately allowing memory reads, writes, and forged attestation reports. Skyfall, a joint effort by ETH Zurich and Google, leverages Transient Scheduler Attacks to extract register values and disk encryption keys from failed VM launches without requiring BIOS modifications. Both attacks were demonstrated on AMD EPYC processors across Zen 3, Zen 4, and Zen 5 generations, with AMD issuing corresponding CVEs and firmware updates scheduled through December 2026. The flaws highlight persistent challenges in confidential computing even when hardware memory encryption is enabled.

The Hacker NewsNov 13, 2026Translated from English