The U.S. Cybersecurity and Infrastructure Safety Company (CISA) on Friday added a high-severity safety flaw impacting UnrealIRCd, an open-source Web Relay Chat (IRC) server, to its Recognized Exploited Vulnerabilities (KEV) catalog, following studies of lively exploitation.
The vulnerability, tracked as CVE-2026-114713 (CVSS rating: 8.6), is a case of improper neutralization of delimiters that might be used to execute arbitrary instructions with server/IRCOp privileges.
“The labeled-response module in UnrealIRCd 6.0.0 earlier than 6.2.7.1 doesn’t escape the IRCv3 ‘label’ message tag when echoing it into replies, which permits any consumer on a community with two or extra linked servers to inject server-to-server instructions which are executed with server authority,” reads the outline of the flaw within the NIST Nationwide Vulnerability Database (NVD).
The addition comes practically per week after UnrealIRCd’s challenge chief, developer, and maintainer, Bram Matthys (aka Syzop), launched UnrealIRCd 6.2.7.1 to deal with a number of safety vulnerabilities recognized with the assistance of synthetic intelligence, together with CVE-2026-114713.
“We’re seeing dangerous guys exploiting this problem on the web proper now,” Matthys mentioned. “Hopefully everybody has hot-patched or up to date their server, or on the very least has the spamfilter workaround deployed. If not, accomplish that ASAP!”
Exploitation makes an attempt are mentioned to have commenced a day after the discharge of the hotfix on November 7, 2026. That mentioned, the precise particulars of the malicious exercise and its finish targets are presently unknown. The maintainer described the vulnerability because the “most important problem” present in UnrealIRCd over the previous 15 years.
Federal Civilian Government Department (FCEB) companies have time till November 16, 2026, to use the fixes below Binding Operational Directive (BOD) 26-04: Prioritizing Safety Updates Based mostly on Threat.
