Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has included a significant vulnerability in UnrealIRCd, an open-source Internet Relay Chat (IRC) server, in its Known Exploited Vulnerabilities catalog. This move follows reports of the flaw being actively exploited. The vulnerability, identified as CVE-2026-114713 with a CVSS score of 8.6, allows for command injection with server-level privileges, posing a serious risk to affected systems.

The flaw arises from improper handling of delimiters in the labeled-response module of UnrealIRCd versions prior to 6.2.7.1. Specifically, it fails to escape the IRCv3 'label' message tag when echoing it into replies. This oversight enables users on a network with multiple linked servers to inject commands that the server executes with elevated authority. Such command injection vulnerabilities can allow attackers to manipulate server operations, potentially leading to unauthorized access or data manipulation.

Bram Matthys, the project leader of UnrealIRCd, released version 6.2.7.1 to mitigate this and other security issues identified with the assistance of artificial intelligence. Reports indicate that these attempts began shortly after the hotfix was issued on November 7, 2026. However, the specifics of the attacks and their objectives remain unclear.

Federal agencies under the Federal Civilian Executive Branch (FCEB) have been directed to implement the necessary updates by November 16, 2026, as per Binding Operational Directive 26-04. This directive underscores the critical nature of the vulnerability and the need for rapid response to mitigate potential threats. The vulnerability is considered the most critical issue discovered in UnrealIRCd in the last 15 years, highlighting its potential impact on IRC networks.