A high-severity vulnerability in UnrealIRCd, an open-source IRC server, is being actively exploited by attackers. Tracked as CVE-2026-114713, the flaw has a CVSS score of 8.6 and allows malicious users to inject server-to-server commands that execute with elevated authority. CISA has added it to its Known Exploited Vulnerabilities catalog, making urgent patching essential for affected organizations.
The vulnerability arises from improper neutralization of delimiters in UnrealIRCd’s labeled-response module. In versions 6.0.0 through 6.2.7.0, the software fails to properly escape the IRCv3 “label” message tag when echoing it in replies. On networks with two or more linked servers, this lets any connected user inject commands into server-to-server communication and potentially perform actions reserved for server or IRC operators.
The flaw is especially serious because it can undermine the trust between linked IRC servers and enable arbitrary command execution. UnrealIRCd maintainer Bram Matthys described it as the most critical UnrealIRCd vulnerability discovered in the past 15 years. Exploitation reportedly began just one day after the security hotfix was released on November 7, 2026, showing that attackers are moving quickly to target unpatched systems.
CISA added the vulnerability to its Known Exploited Vulnerabilities catalog after reports of real-world attacks. Under Binding Operational Directive 26-04, federal civilian executive branch agencies must apply the required fixes by November 16, 2026. The short deadline reflects the urgency of the threat, particularly for internet-facing systems or organizations operating multi-server IRC networks.
Administrators should immediately upgrade UnrealIRCd to version 6.2.7.1 or later, which fixes CVE-2026-114713 and several other vulnerabilities. Those unable to update right away should apply the available spamfilter workaround, review logs for suspicious activity, and ensure every linked server is patched. The incident is a reminder that prompt patching and strong access controls are essential to prevent newly disclosed flaws from becoming active attack vectors.
Read the original article:
Attackers Exploit Critical UnrealIRCd Flaw Enabling Server Command Injection