The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added a high-severity security flaw impacting UnrealIRCd, an open-source Internet Relay Chat (IRC) server, to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation.
The vulnerability, tracked as CVE-2026-114713 (CVSS score: 8.6), is a case of improper neutralization of delimiters that could be used to execute arbitrary commands with server/IRCOp privileges.
“The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 ‘label’ message tag when echoing it into replies, which allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority,” reads the description of the flaw in the NIST National Vulnerability Database (NVD).
The addition comes nearly a week after UnrealIRCd’s project leader, developer, and maintainer, Bram Matthys (aka Syzop), released UnrealIRCd 6.2.7.1 to address multiple security vulnerabilities identified with the help of artificial intelligence, including CVE-2026-114713.
“We are seeing bad guys exploiting this issue on the internet right now,” Matthys said. “Hopefully everyone has hot-patched or updated their server, or at the very least has the spamfilter workaround deployed. If not, do so ASAP!”
Exploitation attempts are said to have commenced a day after the release of the hotfix on November 7, 2026. That said, the exact details of the malicious activity and its end goals are presently unknown. The maintainer described the vulnerability as the “most critical issue” found in UnrealIRCd over the past 15 years.
Federal Civilian Executive Branch (FCEB) agencies have time until November 16, 2026, to apply the fixes under Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk.
