Daily Threat Briefing: Saturday, November 14, 2026

#7 · 2026-11-14 · Severity: Critical

Threat types: vulnerability-exploit, iot-ot · Industries: technology

Verified status

Checked against NVD and CISA KEV on 2026-11-14.

TL;DR

• Top story: Check Point Multiple Products: Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability (CVE-2026-123039)
• Also notable: UnrealIRCd UnrealIRCd: UnrealIRCd Improper Neutralization of Delimiters Vulnerability (CVE-2026-114713); CVE-2026-126173: The AutomatorWP Pro plugin for WordPress’ webhook addon is vulnerable to authorization bypass in all versions…
• 2 new CISA KEV entries in the last 24 hours

Executive summary

Over the past twenty-four hours, threat activity reached an overall critical level driven by multiple new vulnerabilities and active tracking indicators. Security advisories highlight high and critical severity flaws including incorrect permission assignments in Check Point products, delimiter neutralization issues in UnrealIRCd, an authorization bypass in the AutomatorWP Pro plugin webhook addon, a stack-based vulnerability in PLANET GS-5220-8P2T2S firmware, and an authentication bypass in sysPass. Intelligence feeds recorded numerous malicious artifacts and events, alongside new entries in vulnerability databases and ransomware victim reports.

Top threats

1. Check Point Multiple Products: Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability (CVE-2026-123039)

Severity: High | Type: vulnerability-exploit | Industry: cross-industry

Check Point has multiple products affected by an incorrect permission assignment for critical resource vulnerability, identified as CVE-2026-123039 with a CVSS score of 7.8. This security flaw requires remediation, and the deadline for addressing the issue is set for November 16, 2026.

Sources: CISA KEV

Recommended actions:

• Patch or mitigate CVE-2026-123039 following the vendor guidance; CISA set a remediation due date of 2026-11-16.
• Check logs of exposed systems for signs of exploitation before and after patching.

2. UnrealIRCd UnrealIRCd: UnrealIRCd Improper Neutralization of Delimiters Vulnerability (CVE-2026-114713)

Severity: High | Type: vulnerability-exploit | Industry: cross-industry

UnrealIRCd is affected by an improper neutralization of delimiters vulnerability, identified as CVE-2026-114713, which carries a CVSS score of 8.6. The vendor and product are both UnrealIRCd. There is currently no known ransomware use associated with this issue.

Sources: CISA KEV

Recommended actions:

• Patch or mitigate CVE-2026-114713 following the vendor guidance; CISA set a remediation due date of 2026-11-16.
• Check logs of exposed systems for signs of exploitation before and after patching.

3. CVE-2026-126173: The AutomatorWP Pro plugin for WordPress’ webhook addon is vulnerable to authorization bypass in all versions…

Severity: Critical | Type: vulnerability-exploit | Industry: cross-industry

The AutomatorWP Pro plugin for WordPress webhook addon up to version 1.4.4 suffers from an authorization bypass vulnerability due to improper verification of user permissions. This flaw allows unauthenticated attackers to reset the password of any WordPress account, including administrators, leading to full account takeover. Exploitation requires an administrator to have configured a specific automation that pairs a Receive Webhook trigger with an Update-User action.

Sources: NVD

Recommended actions:

• Check whether you run the affected product and apply the vendor fix when it is available.
• Prioritise internet-facing systems.

4. CVE-2026-109445: PLANET GS-5220-8P2T2S (hardware version 3.0) firmware versions before 3.2412b261008 contains a stack-based…

Severity: Critical | Type: vulnerability-exploit, iot-ot | Industry: technology

A stack-based buffer overflow vulnerability exists in PLANET GS-5220-8P2T2S hardware version 3.0 firmware prior to version 3.2412b261008. The flaw occurs when an unauthenticated attacker submits an oversized webstax_auth HTTP cookie that lacks length validation and is copied into a fixed-size stack buffer. This allows attackers to corrupt stack memory, overwrite the saved return address via a crafted HTTP request, and potentially cause a denial of service on the device.

Sources: NVD

Recommended actions:

• Check whether you run the affected product and apply the vendor fix when it is available.
• Prioritise internet-facing systems.

5. CVE-2026-129110: sysPass 3.0.1 through 3.2.11 contains an authentication bypass vulnerability that allows unauthenticated…

Severity: Critical | Type: vulnerability-exploit | Industry: cross-industry

An authentication bypass vulnerability in sysPass versions 3.0.1 through 3.2.11 allows unauthenticated attackers to reinstall an already-installed instance by posting to the install handler. This flaw permits attackers to overwrite the configuration file, redirect the application to an attacker-controlled database, create an administrator account, and execute commands using serialized gadget chains. The vulnerability carries a CVSS score of 9.3.

Sources: NVD

Recommended actions:

• Check whether you run the affected product and apply the vendor fix when it is available.
• Prioritise internet-facing systems.

Ongoing: previously reported

Today’s action checklist

• Patch or mitigate the newly listed CISA KEV vulnerabilities (CVE-2026-123039, CVE-2026-114713) first; they are exploited in the wild and carry a CISA due date.
• Ransomware activity is concentrated in Manufacturing: verify offline backups, patch internet-facing edge devices and review remote-access logins.
• Review the CISA ICS advisories in today’s top threats if you run the affected industrial or IoT products, and keep them off the internet.
• Pull current indicators from the linked abuse.ch and OTX pages and add them to blocklists or detection rules where relevant.
• Read the linked sources for the products you run and subscribe to vendor security notices.

Indicators

18 new ransomware victims were listed in this window.

Raw indicators are not republished here. Pull them from the source pages.

• ThreatFox: 1049 new IOCs (view on threatfox.abuse.ch)
• URLhaus: 100 new malicious URLs (view on urlhaus.abuse.ch)
• MalwareBazaar: 14 new malware samples (view on bazaar.abuse.ch)

Sources

• CISA Known Exploited Vulnerabilities Catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
• CISA Cybersecurity Advisories and ICS Advisories (https://www.cisa.gov/news-events/cybersecurity-advisories)
• This product uses data from the NVD API but is not endorsed or certified by the NVD (https://nvd.nist.gov).
• EPSS scores by FIRST (https://www.first.org/epss)
• Ransomware victim data: ransomware.live (https://www.ransomware.live)
• Data: abuse.ch (URLhaus, ThreatFox, MalwareBazaar), https://abuse.ch. Used non-commercially.
• BleepingComputer (https://www.bleepingcomputer.com/feed/)
• The Hacker News (https://feeds.feedburner.com/TheHackersNews)
• SecurityWeek (https://feeds.feedburner.com/securityweek)
• The Record (https://therecord.media/feed)
• Krebs on Security (https://krebsonsecurity.com/feed/)
• NCSC UK (https://www.ncsc.gov.uk/api/1/services/v1/all-rss-feed.xml)
• CERT-EU (https://cert.europa.eu/publications/security-advisories-rss)

AI-assisted, published automatically, not human-reviewed; verify with vendors before acting.