Attackers are exploiting an UnrealIRCd vulnerability that lets a user inject commands with server authority on chat networks with two or more linked servers. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities catalog on November 13, 2026, making remediation a priority for organizations running affected servers.
The vulnerability, CVE-2026-114713, affects UnrealIRCd versions from 6.0.0 up to, but excluding, 6.2.7.1. UnrealIRCd is an open-source server for Internet Relay Chat (IRC), a protocol for real-time text conversations. The flaw carries a CVSS severity score of 8.6 out of 10.
CISA’s alert confirms evidence of active exploitation. Separately, The Hacker News quoted UnrealIRCd project leader and maintainer Bram Matthys, also known as Syzop, warning that attackers were exploiting the issue on the internet and urging administrators to apply protection immediately.
How a message tag becomes a server command
The problem lies in UnrealIRCd’s labeled-response module, which handles labels attached to messages so replies can be matched to requests. The National Vulnerability Database description, reproduced by The Hacker News, says the module fails to escape the IRCv3 label message tag when copying it into replies.
That failure allows specially crafted label content to be interpreted as server-to-server commands instead of remaining message data. Any user on a network with two or more linked servers can exploit the flaw, with injected commands executed under server authority. The reported impact is arbitrary command execution with server or IRC operator privileges.
The Hacker News reported that exploitation attempts began a day after the November 7, 2026, hotfix release, though the attackers’ activities and objectives remain unknown. Matthys described the vulnerability as the most critical issue found in UnrealIRCd in 15 years.
The report also said Matthys released UnrealIRCd 6.2.7.1 to fix several security vulnerabilities identified with help from artificial intelligence, including CVE-2026-114713.
What administrators should do
Administrators running affected UnrealIRCd servers should update to 6.2.7.1. In the warning quoted by The Hacker News, Matthys also urged operators to apply the hot patch or, at minimum, deploy the spamfilter workaround.
For U.S. Federal Civilian Executive Branch agencies, The Hacker News reports a November 16, 2026, deadline to apply fixes under Binding Operational Directive 26-04. CISA says that directive prioritizes rapid remediation of high-risk cataloged vulnerabilities on publicly exposed assets that grant total control after exploitation, and establishes expectations for checking whether systems were compromised before patching.
CISA added a second vulnerability in the same announcement: CVE-2026-123039, an incorrect permission assignment flaw affecting multiple Check Point products. The directive applies only to federal civilian agencies; CISA encourages all organizations to prioritize remediation of vulnerabilities in its known-exploited catalog.
