UnrealIRCd CVE-2026-114713 Explained: CISA Adds Exploited IRC Label Flaw to KEV — Patch by November 16

Image: UnrealIRCd startup screen (Wikimedia Commons, GPL) — the actual UnrealIRCd server software at startup.

TL;DR — UnrealIRCd CVE-2026-114713 explained: a flaw in the IRCv3 "label" message tag lets any ordinary, unprivileged user inject commands that linked IRC servers then run with server authority. CISA added it to its Known Exploited Vulnerabilities list on 13 November 2026, with a patch deadline of 16 November. Patch now: apply the SPAMFILTER workaround, then hot-patch or upgrade to 6.2.7.1.

Key Highlights

• CVE-2026-114713 (CWE-140, CVSS 3.1 score 8.6 High) is an escaping flaw in UnrealIRCd's IRCv3 "label" tag handling. The project calls it the most critical issue found in UnrealIRCd in the past 15 years.
• Any normal user on a network with two or more linked servers can inject server-to-server commands — KILL, GLINE and more — that run with server authority.
• Affected: UnrealIRCd 6.0.0 to 6.2.7, plus end-of-life 5.x, which has no hot-patch. Versions 3.2.x and 4 are end of life and were not checked, but are likely affected.
• Fix: apply the SPAMFILTER workaround first, then run the no-restart hot-patch (bundle-20261107) or upgrade to 6.2.7.1.
• CISA added the flaw to its KEV catalog on 13 November 2026, due 16 November, with forensic triage required. Ransomware use is listed as unknown.

UnrealIRCd CVE-2026-114713 explained: how the label flaw works

IRC is a text protocol, and in a text protocol a newline is a message boundary. That single fact is the whole story of CVE-2026-114713. UnrealIRCd's labeled-response module implements the IRCv3 "label" message tag — a piece of metadata a client attaches to a message, sent as @label=value before the rest of the line. The module echoed that client-supplied label back into server replies without escaping it. Analysis of the code shows the check validated the tag's length, but not the characters that matter in a text protocol: carriage returns, newlines, semicolons, backslashes and spaces all passed through.

On a single server that would be a nuisance. On a network with two or more linked servers it becomes a takeover. The injected lines travel in server-to-server traffic, and linked servers treat that traffic as trusted — so the attacker's lines are executed as commands with server authority. The maintainer, Bram Matthys, put it plainly in the advisory: "In a text protocol like IRC this means one can issue arbitrary commands, in this case with server authority." The advisory names KILL, which disconnects any user from the network, and GLINE, which sets a network-wide ban, as examples — and notes there are many more.

The flaw was found during an internal security audit conducted with the help of AI. Matthys says he has spent about 100 hours since February 2026 doing AI-assisted audits of the UnrealIRCd codebase, and his conclusion is blunt: if you are running any network daemon that has not seen major security fixes in the past couple of months, nobody has been poking at that daemon with AI — or somebody has, and did not report back. The same release fixes eight other issues, including two ways for an ordinary user to reveal another user's IP address, a hang during blacklist rechecks, a crash triggered through services, a counting error that could tell every new user "this server is full", a flood issue with TLS renegotiations and a possible crash in the WHOWAS database.

Which versions are affected — and which have no fix

The critical flaw affects every supported UnrealIRCd 6 release from 6.0.0 through 6.2.7, and the end-of-life 5.x line is affected too. The older 3.2.x and 4.x lines were not checked, but the maintainer says it is likely that several of the fixed bugs go all the way back to 3.2.x.

Version	Status	What to do
UnrealIRCd 6.0.0 – 6.2.7	Affected	SPAMFILTER workaround, then hot-patch bundle-20261107 or upgrade to 6.2.7.1
UnrealIRCd 5.x	Affected, end of life since 1 July 2023	No hot-patch. Add blacklist-module "labeled-response"; to the config on all servers and restart — or better, upgrade to UnrealIRCd 6
UnrealIRCd 3.2.x, 4.x	End of life, not checked, likely affected	No fix. The advisory is direct: "You are not safe at all." Upgrade to UnrealIRCd 6

Image: Diagram of derivations and relations for common IRC daemon software implementations, including UnrealIRCd (Wikimedia Commons, GPL).

Why it matters: who still runs IRC?

IRC is decades old, but it is far from dead. Gaming communities, open-source projects and hobby networks still run their own IRC servers, and UnrealIRCd is one of the most widely used server programs for doing so — a free, open-source IRC daemon that has been in development since 1999. A single unprivileged account on such a network could, until patched, disconnect users at will, ban whole networks of users, and issue other server-level commands. For a community that treats its chat server as its home, that is a full takeover by anyone who can register an account and read a public advisory.

For readers in India, the picture is the same as everywhere else: no Indian victims have been named, and there is no India-specific data in the advisory or the CISA listing. But Indian open-source communities, gaming clans and hobby networks run IRC servers too, and the check costs nothing — if your network runs UnrealIRCd, the version number is what matters, not where the server sits. The flaw needs two or more linked servers to bite, which is the normal shape of any real IRC network, so a lone test server is the only setup that escapes it.

The timing adds pressure. The fix shipped on Saturday 7 November, the same day as the advisory, which is the right call — but it also means every network that has not patched is now the softest target on the internet for anyone who read the advisory. The project says attackers are already exploiting the flaw, and CISA's listing confirms exploitation in the wild: the KEV catalog only lists flaws with reliable evidence of active exploitation.

How to fix it: three steps, in this order

The advisory prescribes three steps, and the order matters — step 1 protects the network immediately, while steps 2a or 2b fix the underlying bugs.

Step 1 — the workaround, right now. As an IRCOp, run: SPAMFILTER add -regex T block - Invalid_label ^label=(?![^\r\n;\x20]*\z). This protects all linked servers against the critical issue, but only if every server is on 6.0.4 or newer. It does not fix the other eight issues, so do not stop here.

Step 2a — hot-patch, no restart. On every UnrealIRCd server running 6.0.0 to 6.2.7 on a Unix-like system, run: ./unrealircd hot-patch bundle-20261107. Windows servers cannot hot-patch and must use step 2b. Verify the patch with ./unrealircd module-status | grep labeled-response — it should show 5.0-hot-patch-bundle-20261107. If it shows only 5.0, the hot-patch did not apply.

Step 2b — or upgrade to 6.2.7.1. On Unix-like systems, run ./unrealircd upgrade and restart the server; Windows users can download 6.2.7.1 from unrealircd.org. After upgrading, the same module check should show 6.2.7.1.

UnrealIRCd 5 users have no hot-patch and no supported upgrade path in place — the only mitigation is blacklisting the labeled-response module in the configuration on all servers and restarting (a rehash is not enough). The maintainer's advice is unsentimental: "Nobody should be running this version."

CISA's warning and the November 16 deadline

CISA added CVE-2026-114713 to its Known Exploited Vulnerabilities catalog on 13 November 2026, with a remediation deadline of Monday 16 November for US federal civilian agencies under Binding Operational Directive 26-04. The entry also carries a forensic-triage flag, meaning affected agencies must preserve evidence for investigation, and lists known ransomware-campaign use as unknown — exploitation is confirmed, ransomware involvement is not.

The UnrealIRCd listing is part of a busy KEV week. The same catalog already carries the Check Point Gaia flaw added to CISA KEV the same day, the Cisco BroadWorks flaw exploited by an autonomous AI agent, and the Barracuda Email Security Gateway flaws whose federal deadline fell on 13 November. KEV is not a warning list — it is the US government's list of flaws confirmed to be exploited in the wild, and while the deadline binds only federal agencies, CISA urges every organisation to treat KEV entries as patch-first priorities. The pattern this week is worth noting: the Turla Cereal malware on Exchange servers showed the same lesson from the attacker's side — unpatched, internet-facing infrastructure gets found and used.

Should you care?

Patch this weekend if you run an UnrealIRCd network. The deadline is Monday 16 November, exploitation is already happening, and the hot-patch needs no restart — there is no reason to wait. If you only use IRC as a chat user, there is nothing to install, but ask your network's operators whether they have patched, and expect brief maintenance. Even if you never touch IRC, the lesson travels: a fifteen-year-old class of bug, found by an AI-assisted audit of a mature open-source daemon, is a reminder to check the version of every daemon you run — especially the end-of-life ones nobody has looked at in years.

FAQs

What is CVE-2026-114713?
CVE-2026-114713 is an improper neutralization of delimiters flaw (CWE-140) in UnrealIRCd's IRCv3 "label" message tag handling, scored 8.6 High under CVSS 3.1. Any ordinary user on a network with two or more linked servers can inject newlines into server-to-server traffic, so the servers execute the injected lines as commands with server authority.

Which UnrealIRCd versions are affected by CVE-2026-114713?
UnrealIRCd 6.0.0 through 6.2.7 are affected, and the end-of-life 5.x line is affected too. Versions 3.2.x and 4.x are end of life, were not checked, and are likely affected. Only 6.2.7.1 and the bundle-20261107 hot-patch are fixed.

How do I fix UnrealIRCd CVE-2026-114713?
First apply the SPAMFILTER workaround as an IRCOp for immediate protection, then either hot-patch with ./unrealircd hot-patch bundle-20261107 (UnrealIRCd 6.0.0–6.2.7 on Unix-like systems, no restart) or upgrade to 6.2.7.1 and restart. Verify with ./unrealircd module-status | grep labeled-response.

What is UnrealIRCd, and is IRC still used?
UnrealIRCd is a free, open-source IRC server daemon used to run chat networks, and IRC — the text-based chat protocol from the late 1980s — is still widely used by gaming communities, open-source projects and hobby networks. The protocol's age is exactly why this flaw matters: a newline is a message boundary, so a missing escape check becomes a command-injection hole.

Takeaway

A missing escape check in one message tag gave any IRC user the keys to the whole network — and the fix has been available since 7 November. If you run UnrealIRCd, check your version before Monday's deadline: the hot-patch takes minutes and needs no restart.

If you run an UnrealIRCd server, check your version now with ./unrealircd module-status and read the official advisory linked below before the 16 November deadline.

Sources

UnrealIRCd — Security advisory: UnrealIRCd 6.2.7.1 released & hot-patch (CVE-2026-114713) (official advisory, forum topic 9487)
oss-security — UnrealIRCd 6.2.7.1 released & hot-patch (CVE-2026-114713) (maintainer Bram Matthys, 8 November 2026)
CISA — Known Exploited Vulnerabilities Catalog: CVE-2026-114713 (added 13 November 2026, due 16 November 2026)
NVD — CVE-2026-114713 (CVSS 3.1 score 8.6, CWE-140)
Security Online — UnrealIRCd Vulnerability CVE-2026-114713 Exploited in Wild (9 November 2026)
Carthage Electronics — November 13 2026 CVE Threat Brief: Check Point & UnrealIRCd on KEV (13 November 2026)