Check Point CVE-2026-123039 + 3 more

This digest covers information published or updated on November 13 that matters most to small and mid-sized businesses. The top item is Check Point CVE-2026-123039 in gateways and management servers. A world-writable local control socket used by the DynamicCLI process allows local privilege escalation to root (CVSS 7.8). CISA added it to the KEV catalog on November 13, and Check Point has confirmed exploitation against "a couple of dozen" customers. If you use the affected products, apply the Jumbo Hotfix Accumulator and check for signs of compromise first. Detailed steps are in our dedicated Check Point CVE-2026-123039 article.

We also cover UnrealIRCd CVE-2026-114713, which is also in KEV, the arbitrary file read/write affecting apps that use ImageMagick (ImageTragick2), and a heap buffer overflow in the TightVNC and UltraVNC Windows viewers. "Confirmed exploited" here means listed in CISA's KEV catalog or confirmed as exploited by the vendor. Today that is two items: Check Point and UnrealIRCd. No exploitation has been reported for ImageMagick or the VNC viewers. Items from earlier days (Synology, Chrome, Node.js, N-central and others) are not repeated because there are no new facts.

Check Point published CVE-2026-123039 in support article sk1000362. The local control socket used by the DynamicCLI process (/tmp/dynamic_socket) is world-writable, so a low-privileged local user can run commands as root. The CVSS score is 7.8. Because it is a local escalation, it cannot be attacked from outside on its own. However, BleepingComputer reported an attack chain in which attackers first got in through the Mobile Access portal and then used this flaw to gain root (this is from the press report, so treat it separately from what Check Point's support article states).

CISA added the vulnerability to the KEV catalog on November 13, with a federal deadline of November 16. Check Point says it has confirmed exploitation against a couple of dozen customers.

Affected versions are R82.20, R82.10, R82, R81.20, R81.10 (end of support) and R81 (end of support). Affected products are Force Firewalls (security gateways), Management and Log Servers, Multi-Domain Security Management / Multi-Domain Log Server, and Maestro Orchestrator. Spark Firewalls and Smart-1 Cloud are not affected.

The fix is to apply the Jumbo Hotfix Accumulator: Take 14 or later for R82.20, Take 52 or later for R82.10, Take 132 or later for R82, and Take 174 or later for R81.20. R81.10 and R81 are end of support, so no fixed version is listed. You need to move to a supported version.

As a workaround, Check Point describes stopping the dynamic_server process and configuring it not to restart. The side effect is that the Dynamic CLI commands described in sk144112 will fail. Treat this as a stopgap until you can update.

To check, run the command below in Expert mode and look at the socket permissions. A fixed system shows srw-rw---- root config (0660); a vulnerable one shows srwxrwxrwx (0777). Signs of compromise can be checked in /var/log/dynamicCli.log.

Even if you do not run Check Point yourself, your IT contractor or branch networks may use it. Ask them whether they do. For detailed steps, see the dedicated article.

UnrealIRCd is IRC (chat) server software. Its labeled-response module embeds the IRCv3 label message tag in replies without escaping it (CWE-140). On a network with two or more linked servers, an ordinary user can inject server-to-server commands, and may be able to run commands such as KILL and GLINE with server or IRC operator privileges. Red Hat rates it High, and the CVE record is reported to carry a CVSS 3.1 score of 8.6. CISA added it to KEV on November 13 based on evidence of exploitation.

UnrealIRCd 6.0.0 through 6.2.7 is affected. UnrealIRCd 5, which is end of life, is affected in the same way. The fixed version is 6.2.7.1 (released November 7, with 8 other fixes). On \*NIX you can use the hot patch that needs no restart, ./unrealircd hot-patch bundle-20261107. On Windows, upgrade. For UnrealIRCd 5, set blacklist-module "labeled-response"; and restart.

To be honest, this only matters if you run your own IRC server. It is very unlikely to apply to the business systems a typical small company uses. Checking that no IRC server is running internally or in a development team is enough.

CERT/CC published VU#580079 on November 12, and JVN listed it as JVNVU#95718857 on November 13. If ImageMagick is made to process a crafted SVG or PostScript file, files that the ImageMagick process can access can be read and written. Combined with writable executable content, this may lead to code execution. A CVE has been assigned only to the WordPress Variant 2 (CVE-2026-65640); no CVE is listed for the others. No CVSS score is listed, and no exploitation has been reported.

Many web apps use ImageMagick behind the scenes to resize images and generate thumbnails, so the impact differs by product. The published status is as follows.

- Ruby on Rails: affected. Fixed in 8.0.5.2 / 8.1.4.1 (adds a policy.xml for Active Storage's mini_magick)
- Kiteworks (including ownCloud Classic): affected, fix in progress
- MediaWiki: not affected
- Debian, Red Hat, Redmine, Ubuntu, WordPress: unknown (no vendor statement)

The countermeasure is to apply each product's vendor update. Updating ImageMagick alone may not be enough. Switch policy.xml to an allowlist approach, and disable MSL, MVG, PS, EPS and PDF if you do not need them. It also helps to isolate image processing in a least-privilege environment and to validate uploaded files by content rather than by extension. If your site or system lets users upload images, ask your developers or contractor whether ImageMagick is used and how policy.xml is configured.

CERT/CC (VU#644655) and JVN (JVNVU#92656681) both published this on November 13. If a malicious VNC server sends a crafted Tight JPEG update, the viewer's heap buffer overflows. The confirmed impact is a viewer crash (denial of service). Arbitrary code execution has been pointed out as possible but has not been demonstrated. No CVSS score is listed, and no exploitation has been reported.

UltraVNC is fixed in 1.8.2.8, and current releases such as 1.8.3.1 are recommended. TightVNC Windows Viewer 1.3.10 has no fix because the vendor did not respond. Consider replacing it with a maintained product. Until then, connect only to VNC servers you trust. If you use VNC for remote support, it is also safer to confirm which viewer your contractor uses.

- Ask your IT staff or contractor whether your company or branch networks use Check Point firewalls or management servers
- If so, ask about the status of the Jumbo Hotfix (R82.20 Take 14, R82.10 Take 52, R82 Take 132, R81.20 Take 174 or later)
- Whether or not it is applied, ask them to check the permissions of /tmp/dynamic_socket and review /var/log/dynamicCli.log (investigation for signs of compromise)
- If you use R81.10 or R81, confirm the plan to move to a supported version
- Check that you are not running an IRC server (UnrealIRCd). If you are, apply 6.2.7.1 or the hot patch
- If you have a site where users can upload images, ask your contractor whether ImageMagick is used, how policy.xml is configured, and whether vendor updates are applied
- Check that you are not using TightVNC 1.3.10 or an old UltraVNC as a VNC viewer, and plan a replacement if you are
- For products you do not use, record them as "checked, no action needed"

- Check Point CVE-2026-123039 (DynamicCLI root escalation): check and fix
- Previous day's vulnerability digest (Synology and more)
- SonicWall CVE-2026-19868 (SSLVPN SAML/MFA bypass): check and fix
- UTM and firewall costs for small businesses
- Vulnerability assessment costs and how to choose

- Check Point sk1000362: https://support.checkpoint.com/results/sk/sk1000362
- CISA（KEV カタログへの2件追加）: https://www.cisa.gov/news-events/alerts/2026/11/13/cisa-adds-two-known-exploited-vulnerabilities-catalog
- BleepingComputer（Check Point のゼロデイ）: https://www.bleepingcomputer.com/news/security/check-point-patches-zero-day-that-lets-hackers-get-root-access/
- oss-security（UnrealIRCd）: https://seclists.org/oss-sec/2026/q4/576
- UnrealIRCd フォーラム: https://forums.unrealircd.org/viewtopic.php?t=9487
- Red Hat Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2568818
- CERT/CC VU#580079（ImageMagick）: https://kb.cert.org/vuls/id/580079
- JVNVU#95718857: https://jvn.jp/vu/JVNVU95718857/index.html
- Rails アドバイザリ: https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9
- ImageMagick セキュリティポリシー: https://imagemagick.org/script/security-policy.php
- CERT/CC VU#644655（TightVNC・UltraVNC）: https://kb.cert.org/vuls/id/644655
- JVNVU#92656681: https://jvn.jp/vu/JVNVU92656681/index.html