The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity vulnerability affecting UnrealIRCd, an open-source Internet Relay Chat (IRC) server, to its Known Exploited Vulnerabilities (KEV) catalogue following reports of active exploitation. The vulnerability, tracked as CVE-2026-114713, carries a CVSS score of 8.6, placing it in the high-severity category. Its exploitation could allow an unauthenticated user to execute arbitrary commands with server or IRC operator privileges under specific network conditions. CISA added the flaw to its catalogue on November 13, 2026, indicating that the vulnerability has been identified as actively exploited. The listing highlights the security risks associated with the affected software and the importance of applying available fixes. The issue is particularly relevant to administrators managing IRC networks that use multiple linked servers, as the vulnerability involves communication between those systems. CISA’s KEV catalogue is used to identify vulnerabilities known to be exploited and help organisations prioritise remediation efforts.
According to the vulnerability description published in the National Vulnerability Database, the flaw affects the labeled-response module in UnrealIRCd versions from 6.0.0 up to, but not including, 6.2.7.1. The module does not properly escape the IRCv3 “label” message tag when including it in replies. This improper handling of delimiters can allow a user on a network with two or more linked servers to inject additional server-to-server commands. These commands can then be processed with server authority, potentially allowing actions that would normally require elevated privileges. The issue is classified as CWE-140, which relates to the improper neutralisation of delimiters. The CVSS score of 8.6 reflects the potential impact of exploitation, including the ability to affect the integrity of the server environment. The vulnerability does not require prior privileges or user interaction according to its published CVSS vector, making the issue particularly important for administrators operating affected configurations. However, the documented exploitation condition involving linked servers is an important technical detail and should not be omitted when describing the risk.
The addition to CISA’s catalogue follows a security release issued by UnrealIRCd project leader, developer and maintainer Bram Matthys, also known as Syzop, on November 7, 2026. The release, UnrealIRCd 6.2.7.1, addressed nine security issues identified during an internal audit conducted with the assistance of artificial intelligence. CVE-2026-114713 was identified as the most critical issue among those addressed. In a subsequent update to the project’s security announcement, Matthys reported that exploitation was occurring on the internet and urged administrators to update their servers, apply the available hot-patch or use the recommended workaround. He described the vulnerability as the most critical issue identified in UnrealIRCd over the previous 15 years. The developer’s announcement confirms that a fix was made available before CISA added the vulnerability to its KEV catalogue. The exact details of the reported exploitation activity and the objectives of those involved have not been publicly established in the information reviewed.
Under CISA’s Binding Operational Directive 26-04, Federal Civilian Executive Branch agencies have until November 16, 2026, to address the vulnerability in accordance with the directive’s requirements. This deadline applies to the specified U.S. federal agencies and should not be interpreted as a universal deadline for all organisations using UnrealIRCd. Administrators running affected versions are advised to follow the vendor’s remediation guidance and move to UnrealIRCd 6.2.7.1 or a later fixed release. The project also provides a hot-patch option that can address the issue without requiring a server restart, while its advisory documents a temporary workaround involving the disabling of the labeled-response module until the fix is applied. Organisations should consult the official UnrealIRCd security announcement to confirm the appropriate remediation procedure for their installations. The inclusion of CVE-2026-114713 in CISA’s KEV catalogue reinforces the need for administrators to review affected systems, prioritise security updates and assess whether their server environments may have been exposed to exploitation.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
