Vulnerability · high · CVSS 8.6
UnrealIRCd flaw CVE-2026-114713 patched and exploited, CISA adds to KEV
Tier B · Patch this week – Put it in the sprint
Who’s exposed: UnrealIRCd servers; sources do not detail the full impact
Tier B because: Full takeover OR secrets exposed OR supply chain
Reach
Attack
Damage
Fix
Remote, no login · Full takeover
What to do
- Upgrade to UnrealIRCd 6.2.7.1 or apply the hot-patch
The Brief
- UnrealIRCd 6.2.7.1 security release and hot-patch was published on 7 November 2026.
- CVE-2026-114713 is an escaping bug in UnrealIRCd's implementation of the IRCv3 "label" message tag.
- The CVE entry was published on 8 November 2026.
Why it matters
Operators of UnrealIRCd servers should update, since the bug concerns how the server handles a user-supplied IRCv3 message tag.
The checklist behind the tier
Checklist · 3 of 10 yes
| Yes | Hits tech teams | IRC server software run by network operators and ops teams, a server product. |
| No | Core infrastructure | Judgment: a single IRC server product, not software nearly every team runs. |
| No | Popular tool | Judgment: UnrealIRCd is niche, used mainly by IRC networks, not mainstream developer tech. |
| No | Exploited in the wild | Open Source Security: sources describe a security release and CVE only; no observed attacks reported. |
| No | Public exploit | Open Source Security: sources mention only an advisory and escaping bug; no exploit code or PoC reported. |
| Yes | Remote, no login | CVSSCVE-2026-114713: CVSS 8.6 – network, no privileges, no user interaction |
| Yes | Full takeover | CISA SSVCCISA rates the technical impact of CVE-2026-114713 as total |
| No | Secrets exposed | Open Source Security: sources report no stolen credentials, tokens, or data exposure. |
| No | Supply chain | Open Source Security: a normal bug in legitimate code, not malicious code shipped through a channel. |
| No | No fix yet | Open Source Security: security release 6.2.7.1 and hot-patch released, so a fixed version exists. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
CVE-2026-114713 ↗CVSS 8.6 high AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when echoing it into replies, which allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authorit
- Exploited
- Not in CISA’s exploited catalog
- EPSS
- <1% chance of exploitation in the next 30 days · higher than 44% of all CVEs
- Weakness
- CWE-140
Timeline
UnrealIRCd 6.2.7.1 security release and hot-patch published
CVE-2026-114713 entry published
Open Source Security
UnrealIRCd 6.2.7.1 released & hot-patch (CVE-2026-114713)
The Hacker News
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection
Full coverage · 2 sources
- 3h ago ↗
- 6d ago ↗
Open Source Security
UnrealIRCd 6.2.7.1 released & hot-patch (CVE-2026-114713)
First seen · 2 sources · Full story page · How tiers are decided