UnrealIRCd Flaw Hits KEV: Update to 6.2.7.1 Now
CISA added an UnrealIRCd command-injection flaw to KEV after reported exploitation. The fix is 6.2.7.1, and federal agencies have until November 16 to apply it.
Marisol "Fuse" DelgadoPatch this first if you run linked UnrealIRCd servers. CISA added CVE-2026-114713 to its Known Exploited Vulnerabilities catalog on Friday, November 13, 2026, after reports of active exploitation. The fix is UnrealIRCd 6.2.7.1.
What changed
The flaw sits in the labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1. Per the description quoted from the National Vulnerability Database, the module does not escape the IRCv3 “label” message tag when echoing it into replies. On a network with two or more linked servers, that lets any user inject server-to-server commands that run with server authority. The Hacker News reports a CVSS score of 8.6 and classes it as improper neutralization of delimiters.
Maintainer Bram Matthys (Syzop) released 6.2.7.1 nearly a week before the KEV addition. It covers several vulnerabilities found with the help of artificial intelligence, including this one. Matthys has called it the “most critical issue” found in UnrealIRCd in 15 years.
Exploitation status
Matthys said attackers are exploiting it now: “We are seeing bad guys exploiting this issue on the internet right now.” Attempts reportedly began a day after the November 7 hotfix. What the attackers are doing after they get in, and what they want, is not yet public.
What to do
- Update to 6.2.7.1. This is the fix. Do not stop at a workaround.
- If you cannot update today, deploy the spamfilter workaround Matthys referenced, and treat it as a stopgap.
- Check single-server setups too. The reported attack needs two or more linked servers. If you run a standalone server, you are lower priority, but you should still update.
- Review linked servers and IRCOp activity since November 7 for anything you cannot explain. Without published indicators, you are looking for unexpected commands and operator-level changes, not a known signature.
Federal Civilian Executive Branch agencies have until November 16, 2026 to apply fixes under CISA’s Binding Operational Directive 26-04. Everyone else should treat that date as a reasonable target.
Priority call
An IRC daemon is easy to forget, and that is the problem. If it is exposed and linked, it ranks above routine patching this week. If you have no UnrealIRCd, there is nothing to do here.
See also: CISA: Collabora and VeloCloud Flaws Hit KEV and Two KEV Deadlines Hit Today: Arista, Collabora. More in the CISA KEV hub.
Found this useful? Share it.
