Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity security flaw in UnrealIRCd to its Known Exploited Vulnerabilities catalog after reports of active exploitation.
The vulnerability, tracked as CVE-2026-114713 with a CVSS score of 8.6, involves improper neutralization of delimiters that could be used to execute arbitrary commands with server/IRCOp privileges. The flaw affects the labeled-response module in UnrealIRCd 6.0.0 before version 6.2.7.1.
Active Exploitation
Exploitation attempts commenced a day after the release of the hotfix on November 7, 2026. The maintainer described the vulnerability as the "most critical issue" found in UnrealIRCd over the past 15 years.
Federal Response
Federal Civilian Executive Branch agencies have until November 16, 2026, to apply fixes under Binding Operational Directive 26-04, which prioritizes security updates based on risk.
Related
