Actively exploited CVSS 8.6 Security news
Exploited UnrealIRCd flaw CVE-2026-114713 lets any user run commands with server authority
On Friday 13 November 2026 CISA added CVE-2026-114713, a flaw in the UnrealIRCd IRC server, to its Known Exploited Vulnerabilities catalog and gave federal agencies just three days to fix it. The bug in the labeled-response module lets any user on a network with two or more linked servers inject server-to-server commands that are executed with server authority, such as KILL or GLINE. The project's maintainer called it the most critical UnrealIRCd issue in 15 years. The fix shipped on 7 November as version 6.2.7.1 and as a hot-patch that needs no restart.
Key points
- Who is affected: operators of UnrealIRCd networks with linked servers (community and open-source networks, gaming and internal chat). A standalone server with no links has no server-to-server path.
- The bug: the labeled-response module does not escape the IRCv3 "label" message tag when echoing it back. A user can embed a line break followed by a server protocol command, which linked servers then execute as a server command.
- Exploitation: CISA added the flaw to KEV on 13 Nov 2026 and, in the CVE record, rates it as actively exploited and automatable with total technical impact.
- Fix: hot-patch bundle-20261107 (6.0.0 to 6.2.7, no restart) or upgrade to 6.2.7.1. The same fix closes eight other issues, including two user IP address leaks.
Vulnerabilities: CVE-2026-114713
What happened
On Wednesday 4 November 2026 the UnrealIRCd project pre-announced a critical security release, and on Saturday 7 November 2026 it shipped version 6.2.7.1 together with hot-patch bundle-20261107, which loads the fix into a running server without a restart. The release fixes nine security issues, one of them critical: CVE-2026-114713. In his 8 November post to the oss-security list, maintainer Bram Matthys called it the most critical issue found in UnrealIRCd in the past 15 years.
On Friday 13 November 2026 the US CISA added CVE-2026-114713 to its Known Exploited Vulnerabilities (KEV) catalog, with a remediation deadline for federal agencies of 16 November – three days. The same day, CISA's assessment in the CVE record rated it actively exploited, automatable and with total technical impact. Neither CISA nor the project has published details of the attacks.
UnrealIRCd is an open-source IRC server. IRC still carries community and open-source project networks, gaming communities and internal team chat.
Technical details
The details come from the maintainer's advisory and the CVE record. We do not publish exploitation instructions.
- Component: the
labeled-responsemodule (src/modules/labeled-response.c, functionlabeled_response_mtag_is_ok()), which implements the IRCv3labelmessage tag. Clients use the tag to match a server reply to the command that triggered it. - Bug class: CWE-140 (improper neutralization of delimiters); Red Hat lists it as CWE-93 (CRLF injection). The module does not escape the tag when echoing it into replies, so a user can embed line breaks and other characters.
- How the attack works: IRC is a text protocol where each line is one command. A tag value carrying a line break splits into several lines as it is relayed between linked servers, and the linked server processes the extra line as a server protocol command with server authority.
- Preconditions: an ordinary connection to the network is enough; no login or operator privileges are needed (CVSS 3.1 8.6,
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N). The network must have two or more linked servers. - Impact: according to the maintainer, an attacker can run commands with server or IRC operator authority, such as
KILLandGLINE, "and many more bad things".
The same release fixes eight more issues: two user IP address leaks (one of which lets a user "decloak" someone else), a server hang during a blacklist recheck, a crash on CHGIDENT from Services that a normal user can trigger, a counting error that produces "This server is full" on every connection, a limit on bans set by Services, a possible flood via TLS renegotiation, and a possible whowasdb crash.
Who is affected
| Version | Status | Fix |
|---|---|---|
| UnrealIRCd 6.0.0 to 6.2.7 | vulnerable | hot-patch bundle-20261107 or 6.2.7.1 |
| UnrealIRCd 6.2.7.1 | fixed | – |
| UnrealIRCd 5 | vulnerable, end of life since 1 Jul 2023 | blacklist labeled-response and restart, then move to 6.x |
| UnrealIRCd 4 and 3.2.x | not checked by the project, end of life | move to 6.x |
- The critical flaw is exploited on networks with linked servers. The other fixed issues (IP leaks, crashes) also affect standalone servers.
- Red Hat does not ship UnrealIRCd in RHEL; affected installs come from the project directly or from other distributions' packages – check whether your distribution's maintainer has shipped the fix.
How to tell if you were compromised
Neither the project nor CISA has published indicators of compromise. Our own suggestions (not guidance from the project):
- Patch status on every server:
./unrealircd module-status | grep labeled-response–5.0-hot-patch-bundle-20261107or6.2.7.1means safe; a bare5.0means the hot-patch is not installed. Remotely, as an IRC operator, useMODULE -all(orMODULE -all server.namefor a remote server, 6.0.2 and later). - Unexpected kills and bans: review server logs and active bans (
/STATS gline) forKILL,GLINE,ZLINEand mode changes that none of your operators issued. - Label tags in traffic: if you log client traffic, look for
labelvalues containing CR, LF, spaces or semicolons – a valid tag contains none of them. - Configuration and channel changes: channels taken over unexpectedly, new operators, changes in Services.
You can break down the CVSS vector in our CVSS calculator.
What to do
- Patch every server on the network now – the flaw travels across links, so one unpatched server puts the whole network at risk. Unix, 6.0.0 to 6.2.7: run
./unrealircd hot-patch bundle-20261107and wait for "Patch installed and server rehashed correctly". Windows, or if the hot-patch fails: upgrade to 6.2.7.1 (./unrealircd upgrade, then restart). - Verify with
module-statusorMODULE -all(see above) on every server. - Until patched, an IRC operator can deploy the
SPAMFILTERrule from the project's advisory to block invalidlabelvalues. It only works if every server runs 6.0.4 or later and does not replace the fix. - UnrealIRCd 5: add
blacklist-module "labeled-response";to the configuration of every server and restart (a rehash is not enough). Then plan the move to 6.x. - After patching, review bans, operators and channel settings and revert anything you did not set.
Timeline
Updates
- 13 Nov 2026 – first version of this article.
FAQ
I run a single UnrealIRCd server. Am I affected?
The critical flaw is exploited through traffic between linked servers, so a standalone server with no links cannot be attacked this way, as the CVE description also says. The same fix, however, closes eight other issues, including two user IP address leaks, a server hang and crashes. Apply the hot-patch on standalone servers too.
What can an attacker do with it?
According to the maintainer, run commands with server or IRC operator authority, such as KILL (disconnect users) and GLINE (network-wide ban), and many more bad things. In practice that means taking over the network: disconnecting and banning users, seizing channels and changing modes. CISA rates the technical impact as total.
Do I need to restart the server after patching?
On Unix-like systems running 6.0.0 to 6.2.7, no: ./unrealircd hot-patch bundle-20261107 loads the fix into the running server. On Windows, or if the hot-patch fails, upgrade to 6.2.7.1 and restart. For the unsupported 5.x branch the project recommends blacklisting the labeled-response module in the configuration and restarting; a rehash is not enough.
Is the SPAMFILTER workaround enough?
Not permanently. The SPAMFILTER rule in the project's advisory blocks invalid label values, but according to the maintainer it only protects the network if every linked server runs 6.0.4 or later, and it does not fix the other eight issues. Use it only until the fix is installed on all servers.
Has the project published indicators of compromise?
Not as of 13 Nov 2026. Neither the project's advisory nor CISA lists indicators of compromise or detection steps. The checks in the section How to tell if you were compromised are our own recommendations, not guidance from the project.
Sources
- UnrealIRCd – 6.2.7.1 release and hot-patch, oss-security (Bram Matthys, 8 Nov 2026)
- UnrealIRCd – news (6.2.7.1 release, 7 Nov 2026)
- UnrealIRCd – security advisory and updates on the project forum
- CVE.org – CVE-2026-114713 (published 8 Nov 2026, CVSS 8.6, CISA SSVC)
- CISA – Known Exploited Vulnerabilities Catalog, CVE-2026-114713
- Red Hat – CVE-2026-114713 (CWE-93)
Spotted a mistake? Let us know and we will correct it openly.
Related
Actively exploited
Openwave Webtop Media Transcoder: an old document converter flaw is now exploited
Run Openwave Webtop webmail for your customers? Media Transcoder versions before 1.1.22.0 ignore the file type restrictions the administrator has set. The vendor has confirmed attacks and CISA added the flaw to its exploited list on 10 November, even though the vendor says the fixed release shipped back in December 2021.
Actively exploited
IBM Aspera Faspex: an authorization flaw hands users full admin rights, and it is already exploited
Use IBM Aspera Faspex 5 to move large files? On 7 November 2026 IBM fixed CVE-2026-123218, which lets an ordinary signed-in user take full administrative control. Two days later CISA added it to its list of known exploited vulnerabilities and gave US federal agencies only until 12 November to fix it.
Actively exploited
Cisco BroadWorks: an August XXE flaw is now exploited, and attackers are stealing server private keys
Run Cisco BroadWorks? CVE-2026-20320 has been fixed since 19 August 2026, but CISA added it to its exploited list on 10 November. Malbear Labs has described an intrusion at a European telecoms provider in which the attacker used it to steal the server's private keys and certificates.