CISA adds two exploited flaws to its KEV catalogue

CISA added CVE-2026-114713 and CVE-2026-123039 to its Known Exploited Vulnerabilities catalogue on 13 November 2026, with a remediation deadline of 16 November for both entries.CISACISA CVE-2026-114713 affects UnrealIRCd and can let a user on a network with two or more linked servers inject commands into server-to-server communications, where they run with server authority; it has a CVSS score of 8.6, rated HIGH.CISA CVE-2026-123039 affects Check Point Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway and Security Management Server products, and can let an authenticated local user run commands as root through an incorrectly permissioned Gaia OS DynamicCLI daemon; its CVSS score is 7.8, rated HIGH.CISA CISA’s KEV listings confirm exploitation of both flaws, while ransomware use is unknown for each.CISACISA

Microsoft Threat Intelligence said a campaign targeting cloud-hosted ConnectWise ScreenConnect instances belonging to managed service providers was active from 11 November 2026.Microsoft Microsoft said the SCKit worm uses commands issued through ScreenConnect to install an unauthorised remote-access client on customer endpoints, then propagates towards technician workstations.Microsoft The campaign’s RelayTrap component delivers payloads to connecting technicians and establishes persistence, while a separate path targets technician browser cookies to obtain authenticated session material for further access to the management console.Microsoft Microsoft described an attack chain involving an MSI installer, a PowerShell decoder and a watcher that reuses ScreenConnect sessions to deploy payloads to other managed devices; it did not state how many providers or customers were affected.Microsoft

US and European law enforcement agencies disrupted infrastructure associated with Gootloader, CastleRAT and StealC in Operation Endgame, SecurityWeek reported on 13 November.SecurityWeek SecurityWeek said investigators seized 235 servers and 257 domains, while the European operation included 14 Gootloader servers and 218 related domains; it also reported that 681 infected websites had been cleaned up.SecurityWeek Security Affairs reported that Gootloader had infected at least 25,000 computers worldwide since 2018 and had been used in ransomware campaigns affecting at least 44 US-based victims, with around $28.8 million in losses.Security Affairs Security Affairs described the Gootloader action as removing the malware from more than 100 computer servers, while SecurityWeek gave a wider combined seizure count for the three malware operations.Security AffairsSecurityWeek

The FAA lifted its nationwide ground stop at 8:15 p.m.CyberSIXT ET on Friday, after a telecommunications outage affecting Air Route Traffic Control Centers had halted departing flights for more than four hours, CyberSIXT reported.CyberSIXT Homeland Security Secretary Markwayne Mullin said officials had seen zero evidence of a cyberattack, and Transportation Secretary Sean Duffy blamed decades-old analogue equipment; the FAA has not named the failed component.CyberSIXT CyberSIXT reported that more than 3,500 aircraft were in the air when the stop was issued and that more than 3,300 US flights had been cancelled and more than 10,200 delayed by 6:40 p.m.CyberSIXT ET, citing FlightAware figures reported by The Wall Street Journal.CyberSIXT