CISA has added a high-severity UnrealIRCd flaw, CVE-2026-114713, to its Known Exploited Vulnerabilities (KEV) catalog after reports of active exploitation.
What happened
UnrealIRCd is an open-source Internet Relay Chat (IRC) server. The bug sits in the labeled-response module, which does not escape the IRCv3 label message tag when echoing it back in replies. That is an improper neutralization of delimiters issue.
On a network with two or more linked servers, any connected user can use this to inject server-to-server commands that execute with server authority.
| Item | Detail |
|---|---|
| CVE | CVE-2026-114713 |
| CVSS | 8.6 (high) |
| Affected | UnrealIRCd 6.0.0 up to, but not including, 6.2.7.1 |
| Fixed in | 6.2.7.1 |
| Exploitation | Observed in the wild |
Exploitation
Per the report, exploitation attempts began about a day after a hotfix was published on November 7, 2026. Maintainer Bram Matthys said, "We are seeing bad guys exploiting this issue on the internet right now," and called it the most critical issue in UnrealIRCd in 15 years. What attackers are doing with the access has not been disclosed.
What to do
- Update to UnrealIRCd 6.2.7.1 as soon as possible.
- If you cannot patch immediately, apply the spamfilter workaround the maintainer published.
- Review IRC operator and server-link logs for unexpected server commands or new operators.
- Federal civilian agencies must remediate by November 16, 2026 under BOD 26-04.