The CVE record says the module fails to escape an IRCv3 label when it returns a reply. On networks with two or more linked servers, an ordinary user can cause server-to-server commands to run with server authority.UnrealIRCd says those commands can also have IRCOp authority, including the ability to remove users or impose network bans. This is an IRC network privilege escalation, not a claim of operating system command execution.
What it allows
How Does CVE-2026-114713 Cross Server Authority?
The CVE record identifies an escaping failure in the labeled-response module. A client-supplied label is echoed into a reply without neutralizing delimiters, so a linked server can interpret it as a separate server-to-server command.
The described attack requires at least two linked UnrealIRCd servers. The vendor says an ordinary user can gain server or IRCOp command effects, including network bans and user removal. The source does not describe operating system code execution.
UnrealIRCd reported internet abuse attempts on November 8, 2026. CISA added the vulnerability to KEV on November 13, which establishes its known exploitation status. For exposure tracking across the linked network, see Brandefense Vulnerability Intelligence.
Brandefense Blackhole counted nine matching dark-chat posts from August 16 through November 14, 2026. The unit is posts matching CVE-2026-114713, not distinct incidents or verified compromises. A separate GitHub search on November 14 found three public repositories naming the CVE, including one labeled as a proof of concept by its author.
Our assessment is to prioritize every linked server in the network, then review IRC operator and server logs for unexpected privilege changes, network bans, and user removals. Treat the post and repository counts as discussion signals, not evidence that a particular network was compromised. The incident response plan template can help structure that review.
Who is affected
Which UnrealIRCd Servers Need CVE-2026-114713 Remediation?
The CVE record covers UnrealIRCd 6.0.0 through 6.2.7 when two or more servers are linked. UnrealIRCd 6.2.7.1 fixes the flaw. The vendor also says its November 7 hot-patch bundle applies to UnrealIRCd 6.0.0 through 6.2.7 on supported Unix-like hosts.
The vendor says UnrealIRCd 5 is similarly affected, but that branch has been unsupported since July 2023. Its temporary mitigation requires disabling the labeled-response module on every server and restarting them. The vendor has not checked versions 3.2.x or 4 for this issue, so their status should not be inferred from the 6.x range.
UnrealIRCd offers a network-wide temporary spamfilter workaround only when every linked server runs 6.0.4 or newer. It does not replace the patch or update. Inventory each linked server, its running version, platform, and patch state; use the vulnerability management guide to record owner and verification evidence.
Timeline
- 2026-11-07
UnrealIRCd released 6.2.7.1 and a hot-patch bundle for the issue.
- 2026-11-08
The UnrealIRCd developer reported seeing abuse attempts against vulnerable networks.
- 2026-11-13
CISA added CVE-2026-114713 to its Known Exploited Vulnerabilities catalog, with a November 16 federal due date.
What to do
-
Map all linked servers
Record every server's running UnrealIRCd version and platform. Prioritize networks with two or more linked servers, because the documented command injection crosses a server link.
-
Apply the vendor's temporary protection
Follow the vendor advisory for its network-wide spamfilter workaround only if every linked server is on 6.0.4 or later. Treat this as interim protection while completing the update or hot-patch.
-
Patch or upgrade every server
Upgrade each UnrealIRCd 6 server to 6.2.7.1, or use the vendor's November 7 hot-patch bundle where supported. On Windows or after a failed hot-patch, upgrade instead. Replace unsupported UnrealIRCd 5; follow the vendor's temporary module-disable and restart guidance until migration.
-
Verify the running fix on each server
Check the labeled-response module status locally or through an authorized IRCOp view. Confirm version 6.2.7.1 or the November 7 hot-patch bundle on every linked server; an unpatched module still reporting version 5.0 is insufficient.
-
Review abuse and meet the KEV deadline
Review operator and server logs for unexpected network bans, user removals, or privilege changes. CISA lists November 16, 2026 as the remediation due date for covered federal agencies and calls for forensic triage.
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Vulnerability intelligence platform
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
Can CVE-2026-114713 execute operating system commands?
The primary sources describe server-to-server commands executed with IRC server authority. They do not describe operating system command execution.
Is a single UnrealIRCd server exposed to this attack chain?
The CVE record specifies networks with at least two linked servers. Assess other server issues separately under the vendor's broader release advisory.
Which update fixes CVE-2026-114713?
UnrealIRCd 6.2.7.1 fixes it. The vendor also offers a November 7 hot-patch bundle for supported Unix-like 6.0.0 through 6.2.7 installations.
Why is this treated as exploited?
The vendor reported abuse attempts on November 8, 2026. CISA added the CVE to its Known Exploited Vulnerabilities catalog on November 13.
