WORLDTECHAttackers Exploit UnrealIRCd Command-Injection Flaw Rated 8.6
The U.S. Cybersecurity and Infrastructure Security Agency has added a high-severity flaw in the open-source UnrealIRCd IRC server to its Known Exploited Vulnerabilities catalog, citing reports of active exploitation. The flaw can be abused to inject commands at server level.
Flaw scored 8.6 and enables server-level commands
The vulnerability is tracked as CVE-2026-114713 and has a CVSS score of 8.6. It is classified as improper neutralization of delimiters, a weakness that can be used to run arbitrary commands with server or IRCOp privileges.
The National Vulnerability Database describes the problem in the labeled-response module of UnrealIRCd versions before 6.2.7.1. According to that description, the module fails to escape the IRCv3 label tag when echoing it into replies, which lets any user on a network with two or more linked servers inject server-to-server commands that run with server authority.
Patch arrived before exploitation was reported
Project leader, developer and maintainer Bram Matthys, also known as Syzop, released UnrealIRCd 6.2.7.1 to close several security vulnerabilities identified with the help of artificial intelligence, this one among them. He described the flaw as the most critical issue found in UnrealIRCd over the past 15 years.
Exploitation attempts are reported to have started a day after the hotfix appeared on November 7, 2026. The exact details of the malicious activity and its end goals are not yet known.
Federal deadline for agencies to patch
Federal Civilian Executive Branch agencies have until November 16, 2026 to apply the fixes under Binding Operational Directive 26-04, which ranks security updates by risk.
Open questions
- What are the attackers doing with this flaw?
- How many UnrealIRCd servers remain unpatched?