CISA has added a command-injection vulnerability in the UnrealIRCd internet relay chat server to its Known Exploited Vulnerabilities catalog after evidence of active attacks.
The flaw, tracked as CVE-2026-114713, affects the server’s labeled-response module and can let an ordinary user inject commands that run with server or IRC operator authority on networks with two or more linked servers. CISA added the issue on November 13 and set November 16, 2026, as the remediation deadline for Federal Civilian Executive Branch agencies. The agency’s security alert names the UnrealIRCd flaw among two newly listed vulnerabilities, while the KEV catalog records its exploitation status and due date.
The vulnerability affects UnrealIRCd versions 6.0.0 through 6.2.7. The labeled-response module fails to escape the IRCv3 label message tag when it echoes the value in a reply, allowing a crafted tag to break into the server-to-server message stream. The resulting commands can be processed with server-level authority. The CVE record assigns the flaw a CVSS 3.1 score of 8.6, with network access, no required privileges and no user interaction.
UnrealIRCd’s maintainer said in the project’s security advisory that attackers were exploiting the issue on the internet. The maintainer described the flaw as allowing a normal user to issue commands normally reserved for server operators, including commands that can disconnect users or place network-wide bans. The public advisory does not identify the attackers or name affected networks.
The project released UnrealIRCd 6.2.7.1 and a hot-patch bundle named bundle-20261107 to address the vulnerability alongside eight other security issues. The hot-patch applies to UnrealIRCd 6.0.0 through 6.2.7 and can be installed without restarting the server on supported systems. The maintainer also said the flaw affects the end-of-life UnrealIRCd 5 branch, which has not received support since July 2023. The GitHub security advisory records the affected version range and links to the project’s release information.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
