CISA Adds Actively Exploited UnrealIRCd Flaw to KEV Catalog

CISA on Friday added a high-severity flaw in UnrealIRCd, an open-source IRC server, to its Known Exploited Vulnerabilities catalog following reports of active exploitation. The vulnerability, CVE-2026-114713, has a CVSS score of 8.6 and could allow arbitrary commands to run with server or IRCOp privileges. Federal Civilian Executive Branch agencies must apply fixes by November 16, 2026, under Binding Operational Directive 26-04.

What the flaw allows

The flaw is described as improper neutralization of delimiters. According to the NIST National Vulnerability Database description, the labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 'label' message tag when echoing it into replies. This allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority.

Exploitation and maintainer response

UnrealIRCd project leader, developer, and maintainer Bram Matthys, also known as Syzop, released UnrealIRCd 6.2.7.1 to address multiple security vulnerabilities identified with the help of artificial intelligence, including CVE-2026-114713. CISA's addition came nearly a week after that release. Matthys said, 'We are seeing bad guys exploiting this issue on the internet right now,' and urged users to hot-patch or update their servers, or at least deploy the spamfilter workaround, as soon as possible.

Exploitation attempts are said to have commenced a day after the release of the hotfix on November 7, 2026. The exact details of the malicious activity and its end goals are presently unknown. Matthys described the vulnerability as the 'most critical issue' found in UnrealIRCd over the past 15 years.

Deadline for federal agencies

Federal Civilian Executive Branch agencies have time until November 16, 2026, to apply the fixes under Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk.

Sources: The Hacker News