Attackers Exploit UnrealIRCd Vulnerability Enabling Server-Level Command Injection
FHN 
A high-severity security vulnerability affecting UnrealIRCd, an open-source Internet Relay Chat (IRC) server, is being actively exploited in the wild, prompting the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add it to its Known Exploited Vulnerabilities (KEV) catalog.
Tracked as CVE-2026-114713, the vulnerability carries a CVSS score of 8.6 and could allow attackers to inject malicious server-to-server commands that execute with server-level authority.
CISA added the flaw to its KEV catalog on November 13, 2026, following reports of active exploitation.
Technical Details of CVE-2026-114713
The vulnerability originates in UnrealIRCd’s labeled-response module, which fails to properly escape the IRCv3 label message tag when including it in server replies.
An attacker can exploit this improper input handling to inject specially crafted server-to-server commands through the message tag.
The commands can subsequently be processed by linked IRC servers and executed with server authority, potentially compromising the integrity of the affected IRC network.
According to the vulnerability description, exploitation requires an IRC network containing at least two linked servers. However, an attacker does not need authentication or prior privileges to exploit the flaw.
Key vulnerability details:
- CVE ID: CVE-2026-114713
- CVSS Score: 8.6 (High)
- Vulnerability Type: Command Injection
- Affected Component: UnrealIRCd
labeled-responsemodule - Affected Versions: UnrealIRCd 6.0.0 through versions before 6.2.7.1
- Attack Vector: Network
- Privileges Required: None
- User Interaction: None
Active Exploitation Confirmed
UnrealIRCd’s project maintainer, Bram Matthys, confirmed that attackers were actively exploiting the vulnerability.
According to the maintainer, exploitation attempts began on November 7, 2026, shortly after the security fix became available.
The exact details of the attacks, including their objectives and the extent of successful compromises, remain unknown.
The maintainer described the vulnerability as the most critical issue discovered in UnrealIRCd in approximately 15 years and urged administrators to apply the available security updates immediately.
CISA Adds the Vulnerability to Its KEV Catalog
CISA’s addition of CVE-2026-114713 to its Known Exploited Vulnerabilities catalog highlights the immediate risk posed by the flaw.
Under the applicable federal directive, Federal Civilian Executive Branch (FCEB) agencies are required to address the vulnerability by November 16, 2026.
The inclusion in the KEV catalog indicates that the vulnerability has evidence of exploitation and should receive priority in security remediation activities.
About the Author
