UnrealIRCd CVE-2026-114713 exploited, added to CISA KEV

UnrealIRCd is being exploited in the wild through CVE-2026-114713 (CVSS 8.6), an escaping flaw in its IRCv3 label message tag that lets any ordinary user inject commands that run with server authority. CISA added it to the Known Exploited Vulnerabilities catalog on November 13 with a November 16 remediation deadline for federal civilian agencies. The fix is in UnrealIRCd 6.2.7.1. If you run a linked IRC network, patch now.

What the bug does

Per the maintainer's advisory, the labeled-response module does not escape the IRCv3 label tag when it echoes the value back into replies. On any network with two or more linked servers, a user can embed newlines and other delimiters in the tag and inject server-to-server commands, which then execute with server authority — up to IRCOp-level privileges. Maintainer Bram Matthys (Syzop) called it the most critical issue in UnrealIRCd in 15 years.

Affected versions

• UnrealIRCd 6.0.0 through 6.2.7 — vulnerable. Fixed in 6.2.7.1, released November 7, 2026. Admins who cannot jump to 6.2.7.1 can apply the maintainer's hot-patch: ./unrealircd hot-patch bundle-20261107.
• UnrealIRCd 5 — also affected by the critical issue (end-of-life; no fixed release).
• The 6.2.7.1 release closes nine flaws in total; CVE-2026-114713 is the only critical one.

Exploitation status

The maintainer states exploitation is live: "We are seeing bad guys exploiting this issue on the internet right now." Red Hat's Bugzilla entry records that upstream reports active exploitation attempts, which reportedly began within a day of the November 7 release. The CISA KEV listing (added November 13, due November 16 under BOD 26-04) is the second confirmation. Upstream has not published IOCs, so there are none to embed here.

Action checklist

1. Upgrade to UnrealIRCd 6.2.7.1 on every linked server, or apply hot-patch bundle-20261107 on 6.0.0–6.2.7.
2. If you cannot patch immediately, apply the maintainer's SPAMFILTER workaround from the advisory — but copy the regex from the original advisory, not from a reposted copy, because the escaping is easy to mangle. It blocks the critical issue only; the other eight flaws still need the update.
3. On end-of-life UnrealIRCd 5, the maintainer's stated workaround is adding blacklist-module "labeled-response"; to the config on all servers and restarting (not rehashing) — then plan a migration off the EOL branch.
4. Hunt for abuse: review server-to-server command logs for unexpected IRCOp actions dating back to around November 7.

Context

Federal agencies had three days from the KEV listing to the deadline — the compressed clock CISA now reserves for bugs already being hit. IRC daemons rarely make security headlines, but UnrealIRCd backs a large share of the remaining public IRC networks, and server-authority command injection on a linked network propagates across every connected node. The hot-patch path is the fast lane; take it if a full upgrade needs a maintenance window.