UnrealIRCd Flaw CVE-2026-114713 Added to CISA KEV Catalog

Executive Summary

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-114713, a high-severity command injection vulnerability in the popular UnrealIRCd server software, to its Known Exploited Vulnerabilities (KEV) catalog. The flaw, with a CVSS score of 8.6, allows a low-privileged user to execute arbitrary commands with the permissions of the IRC server, potentially leading to a full system compromise. Active exploitation was detected just 24 hours after a patch was released, making this a time-sensitive threat. Federal agencies are mandated to patch by November 16, 2026, and all administrators of public-facing UnrealIRCd servers are urged to update immediately.

Vulnerability Details

The vulnerability exists in the labeled-response module of UnrealIRCd versions 6.0.0 through 6.2.7.1. The software fails to properly sanitize the IRCv3 'label' message tag when it is echoed back in server replies. This improper neutralization of delimiters allows an attacker to inject server-to-server protocol commands.

The attack vector requires an IRC network with at least two linked servers. A malicious user on any server in the network can craft a message with a malicious label. When this label is processed and relayed, the injected commands are executed by the remote server. The commands run with the full authority of the UnrealIRCd process, which could be root or a dedicated user, or as an IRC Operator (IRCOp), granting the attacker significant control over the IRC network and potentially the underlying server.

Affected Systems

• Product: UnrealIRCd
• Affected Versions: 6.0.0 up to (but not including) 6.2.7.1

Any organization running a public or private IRC network using these versions of UnrealIRCd is at risk.

Exploitation Status

Active exploitation of CVE-2026-114713 was confirmed to have begun on November 8, 2026, just one day after the patch was released in version 6.2.7.1 on November 7, 2026. The lead developer of UnrealIRCd described the flaw as the "most critical issue" in the software in the last 15 years and issued a strong public warning about ongoing attacks. Due to this confirmed in-the-wild exploitation, CISA has added it to the KEV catalog, underscoring the urgency for remediation.

Impact Assessment

Successful exploitation of this vulnerability grants an attacker command execution capabilities on the target IRC server. This can lead to a complete server takeover, allowing the attacker to steal sensitive information, disrupt IRC network operations, use the server as a pivot point for further attacks into the host's network, or use the server as part of a botnet. Given the widespread use of UnrealIRCd for community and business communications, the potential for disruption and follow-on attacks is significant.

Cyber Observables — Hunting Hints

The following patterns may help identify vulnerable or compromised systems:

Detection Methods

• Version Scanning: The most reliable method of detection is to perform a version scan across the environment to identify all instances of UnrealIRCd and check if they are within the vulnerable range (6.0.0 to < 6.2.7.1). Asset management tools or network scanners can automate this process.
• Log Analysis: Configure SIEM or log analysis platforms to ingest UnrealIRCd logs. Create alerts for suspicious patterns in server-to-server traffic or error messages that could indicate an injection attempt. This corresponds to D3FEND's Protocol-based Flow Analysis.

Remediation Steps

1. Update Immediately: The primary remediation is to update all UnrealIRCd instances to version 6.2.7.1 or later. This version contains the patch for CVE-2026-114713 and eight other security issues.
2. Apply Workaround: If immediate updating is not possible, the UnrealIRCd project has provided a workaround that involves deploying a specific spamfilter block to the configuration file. This can mitigate the issue but is considered a temporary solution.
3. Verify Patch: After updating, confirm the new version is running correctly and that the server operates as expected.
4. Hunt for Compromise: Review logs for any signs of exploitation that may have occurred prior to patching. Look for unauthorized user accounts, suspicious running processes, or unexpected outbound network connections from the IRC server.