CISA Flags Actively Exploited UnrealIRCd Flaw CVE-2026-114713

On Friday, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a high-severity flaw in UnrealIRCd, tracked as CVE-2026-114713 with a CVSS score of 8.6, to its Known Exploited Vulnerabilities (KEV) catalog following reports of active exploitation. Affecting UnrealIRCd versions 6.0.0 before 6.2.7.1, the flaw enables any user on a network with two or more linked servers to inject server-to-server commands executed with server or IRCOp authority. Administrators running UnrealIRCd should update to version 6.2.7.1, apply the hot-patch, or deploy the spamfilter workaround immediately.

Key Facts

How Does CVE-2026-114713 Enable Command Injection?

CVE-2026-114713 is an improper delimiter neutralisation flaw in the labeled-response module of UnrealIRCd 6.0.0 before 6.2.7.1. Because the module fails to escape the IRCv3 label message tag when echoing replies, any user on a network with two or more linked servers can inject server-to-server commands that run with server or IRCOp privileges.

According to the NIST National Vulnerability Database (NVD) description cited in the report, the vulnerability allows arbitrary command execution with elevated server authority across linked IRC server topologies. UnrealIRCd project leader, developer, and maintainer Bram Matthys, also known as Syzop, released version 6.2.7.1 to resolve CVE-2026-114713 alongside multiple other security vulnerabilities identified with the help of artificial intelligence.

CVE-2026-114713 carries a CVSS score of 8.6 and affects UnrealIRCd versions 6.0.0 prior to 6.2.7.1 on networks with at least two linked servers.

Is CVE-2026-114713 Being Exploited in the Wild?

Yes, attackers are actively exploiting CVE-2026-114713 on the internet. Exploitation attempts reportedly commenced one day after UnrealIRCd released its hotfix on November 7, 2026. Although active abuse prompted CISA to add the vulnerability to its Known Exploited Vulnerabilities catalog, the exact details and end goals of the malicious activity remain unknown.

Maintainer Bram Matthys urged server operators to act without delay, describing CVE-2026-114713 as the "most critical issue" found in UnrealIRCd over the past 15 years.

"We are seeing bad guys exploiting this issue on the internet right now. Hopefully everyone has hot-patched or updated their server, or at the very least has the spamfilter workaround deployed. If not, do so ASAP!"

Bram Matthys (Syzop), UnrealIRCd maintainer

Active exploitation of CVE-2026-114713 began a day after the November 7, 2026 hotfix release, though attacker objectives have not yet been disclosed.

What Deadlines and Directives Apply to Remediation?

Following reports of active exploitation, CISA placed CVE-2026-114713 on its Known Exploited Vulnerabilities catalog on Friday, triggering mandatory remediation deadlines for US federal agencies. Under Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch (FCEB) agencies must apply the vendor fixes by November 16, 2026, to mitigate the risk.

Binding Operational Directive 26-04, titled Prioritizing Security Updates Based on Risk, binds US FCEB agencies while serving as an urgent priority signal for international IT administrators. Even though the directive applies specifically to US federal bodies, organisations in Malaysia operating UnrealIRCd servers face the same internet-wide exploitation activity highlighted by the project maintainer.

Under CISA Binding Operational Directive 26-04, US Federal Civilian Executive Branch agencies have until November 16, 2026, to patch CVE-2026-114713.

What Should You Do?

• Update to UnrealIRCd 6.2.7.1: Check all IRC server deployments for versions 6.0.0 prior to 6.2.7.1 and install the official UnrealIRCd 6.2.7.1 update or vendor hot-patch immediately.
• Apply the spamfilter workaround: If an immediate upgrade or hot-patch is not possible, deploy the spamfilter workaround referenced by the UnrealIRCd maintainer as an interim mitigation.
• Audit linked-server networks: Prioritise environments running two or more linked UnrealIRCd servers, as the flaw allows any user on such networks to inject server-to-server commands.
• Report suspected incidents: Malaysian organisations or administrators who detect signs of compromise or unauthorised server commands should report the incident to Cyber999 (MyCERT).

Common Questions

Which UnrealIRCd versions are vulnerable to CVE-2026-114713?

UnrealIRCd versions 6.0.0 before 6.2.7.1 are affected by CVE-2026-114713. The vulnerability resides in the labeled-response module and impacts networks configured with two or more linked servers. Updating to UnrealIRCd 6.2.7.1 or applying the official hot-patch resolves the flaw.

What can an attacker achieve by exploiting CVE-2026-114713?

According to the NVD description, any user on an affected UnrealIRCd network with two or more linked servers can inject server-to-server commands via the unescaped IRCv3 label tag. These commands execute with server or IRCOp authority, enabling arbitrary command execution.

What should administrators do if they cannot upgrade to 6.2.7.1 immediately?

If upgrading to UnrealIRCd 6.2.7.1 or applying the official hot-patch is delayed, maintainer Bram Matthys advises administrators to deploy the spamfilter workaround at the very least. Because active exploitation is underway on the internet, teams should apply either the patch or workaround urgently.

Sources and Methodology

This dispatch is based solely on reporting from The Hacker News, published on Nov 14, 2026. No external advisories, vendor pages, or additional documents were reviewed or independently verified beyond the provided source text.