A vulnerability in UnrealIRCd, the widely used IRC server software, allows any user on a network with two or more linked servers to inject server-to-server commands that are then executed with server authority. Tracked as CVE-2026-114713, the flaw sits in the labeled-response module, which does not escape the IRCv3 “label” message tag when it echoes that tag back into replies.
The flaw carries a CVSS 3.1 score of 8.6 (High). CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on 2026-11-13, which means exploitation has been confirmed. Administrators running linked UnrealIRCd networks should treat this as urgent.
What’s affected
According to the NVD description, the flaw affects UnrealIRCd 6.0.0 before 6.2.7.1, specifically the labeled-response module. The structured affected-version data in the record lists every version below 6.2.7.1 as affected, without a lower bound. Administrators on older release lines should not assume they are safe until the vendor confirms the full range.
The description says networks with two or more linked servers are exposed, because the injected commands are server-to-server commands. The records do not say whether standalone, single-server installations face any risk.
The advisory data indicates that 6.2.7.1 is the first unaffected version. It does not explicitly confirm whether fixes exist for other release lines.
How serious is it
The CVE Numbering Authority scored the flaw 8.6 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N. In plain terms:
- Network attack vector, low complexity: it can be exploited remotely without special conditions.
- No privileges, no user interaction: an attacker needs no elevated access on the network, and no one else has to take any action.
- Scope changed: the impact extends beyond the vulnerable component. A user’s input ends up being executed with the authority of the server.
- High integrity impact: attackers can make unauthorized changes on the network by issuing commands as a server. The score assigns no direct confidentiality or availability impact.
The weakness is classified as CWE-140, Improper Neutralization of Delimiters. NVD’s own analysis is still in progress (status: Undergoing Analysis).
Is it being exploited?
Yes. CISA added CVE-2026-114713 to the KEV catalog on 2026-11-13, confirming active exploitation. CISA lists ransomware use as “Unknown”.
US federal civilian agencies must apply mitigations according to the vendor’s instructions by 2026-11-16, a deadline only three days after the listing. CISA’s required action also references its BOD 26-04 guidance on prioritizing security updates and its “Forensics Triage Requirements”. Agencies that cannot apply mitigations must discontinue use of the product. Organizations outside the federal government should treat that deadline as a signal of urgency.
What to do
- Upgrade every server on the network to UnrealIRCd 6.2.7.1 or later. Linked servers should all be updated, since the flaw involves server-to-server traffic.
- Read the vendor’s announcement on the UnrealIRCd forums for upgrade instructions and any interim mitigations before you deploy.
- Investigate for compromise. Exploitation is confirmed, so review server logs for unexpected server-originated commands or unexplained changes. CISA’s forensics triage guidance, linked from its KEV notes, may help structure this review.
- Inventory your deployments, including test or secondary networks, so that no linked server is left on a vulnerable version.
