The 3 vulnerabilities from the past week with the strongest evidence of real-world attack, ranked by that evidence first and the likelihood of exploitation second. 3 are confirmed or reported exploited in the wild.
-
CVE-2026-123039 Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability
Check Point Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway, and Security Management Server contain an incorrect permissions assignment for critical resources vulnerability when the Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket without authenticating connecting processes. An authe… (CISA)
- Exploited in the wild: listed by CISA on Nov 13; US federal agencies must fix it by Nov 16.
- VulnCheck KEV: reported exploited (listed Nov 12), 3 reports. 1 day before CISA. First report: research.checkpoint.com.
- Likelihood (EPSS): 1.3% chance of exploitation activity in the next 30 days, higher than 70% of all CVEs.
What to do (CISA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Our analysis: what it is and how to fix it · NVD record and vendor links
-
CVE-2026-114713 UnrealIRCd Improper Neutralization of Delimiters Vulnerability
UnrealIRCd UnrealIRCd contains an improper neutralization of delimiters vulnerability that allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority. (CISA)
- Exploited in the wild: listed by CISA on Nov 13; US federal agencies must fix it by Nov 16.
- VulnCheck KEV: reported exploited (listed Nov 8), 2 reports. 5 days before CISA. First report: forums.unrealircd.org.
- Likelihood (EPSS): 0.30% chance of exploitation activity in the next 30 days, higher than 23% of all CVEs.
What to do (CISA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
-
CVE-2026-124010
XWEB EVO before 5.6.2 contains a command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands as root by exploiting the setuid-root CGI xwconsole.cgi. Attackers can supply malicious input through the sh parameter, which is passed unsanitized to popen(), to achieve full system compromise. This product line reache… (NVD, CVSS 9.8)
- VulnCheck KEV: reported exploited (listed Nov 13), 3 reports. Not yet in CISA’s catalog.
- Likelihood (EPSS): 3.1% chance of exploitation activity in the next 30 days, higher than 88% of all CVEs.
Our analysis: what it is and how to fix it · NVD record and vendor links
How we rank
Evidence that attackers are using a flaw comes first: CISA’s Known Exploited Vulnerabilities catalog, VulnCheck KEV and CISA’s own SSVC assessment. Then the likelihood of attack in the next 30 days from FIRST’s Exploit Prediction Scoring System (EPSS), then severity. A high severity score alone doesn’t make the list. Flaws in AI systems and agent tools are weighted up because they are a fast-growing target. Everything here comes straight from those sources; nothing is estimated by us.
EPSS scores are from FIRST.org. Exploitation reports marked VulnCheck KEV are from VulnCheck’s Known Exploited Vulnerabilities catalog (data © VulnCheck). Always confirm the fixed version in the vendor’s advisory.