UnrealIRCd KEV Response: Verify Every Linked Server

UnrealIRCd CVE-2026-114713 KEV listing changes the response priority for operators of linked IRC networks. The flaw lets an ordinary network user trigger commands with server authority when two or more UnrealIRCd servers are linked. UnrealIRCd reported abuse attempts, and CISA added the CVE to its Known Exploited Vulnerabilities catalog on November 13, 2026.

Start with a map of every server link, then record the running version and fix state of each node. A completed change ticket for one server does not establish that its peers are protected. CISA lists November 16 as the remediation deadline for covered federal agencies; other operators should use the evidence to set their own urgent response window.

UnrealIRCd CVE-2026-114713 KEV: What Changed?

UnrealIRCd published version 6.2.7.1 and a hot-patch bundle on November 7. Its updated advisory says the project was seeing exploitation on the internet. In a November 8 follow-up, the lead developer said abuse attempts had begun that Sunday. CISA added the CVE to KEV on November 13, five days after that follow-up.

The KEV listing is a prioritization signal, not a new technical flaw. CISA describes improper neutralization of delimiters and requires two or more linked servers for the documented server-to-server command injection. The effect is IRC server authority. Neither the vendor advisory nor CISA’s entry establishes operating system code execution, a named threat actor, or a particular victim.

For the weakness and affected-version details, use the CVE record in the operator’s vulnerability inventory. The practical question here is whether every server in a linked network has reached a verified safe state. For broader exposure prioritization, see the vulnerability intelligence platform.

Which IRC Networks Should Operators Inventory First?

Identify networks with at least two linked UnrealIRCd servers, then list every node and its running version. The CVE record covers version 6.0.0 through 6.2.7. A standalone server does not meet this CVE’s documented multi-server condition, although the vendor’s release fixes other security issues too.

Record each node’s platform and whether it runs the November 7 bundle or version 6.2.7.1. The vendor says its hot-patch works on Unix-like installations of UnrealIRCd 6.0.0 through 6.2.7, while Windows users should upgrade. Unsupported UnrealIRCd 5 is also affected, according to the vendor, and needs a migration plan rather than a 6.x patch assumption.

This is a topology task as well as a version task. A vulnerable secondary node can remain linked after the public-facing server is fixed. Use a single network inventory and assign an owner to each node. The vulnerability management process guide provides a way to record ownership and verification.

How Should Teams Confirm Protection on Every Server?

The vendor offers two permanent fix paths: install the supported hot-patch bundle or upgrade to 6.2.7.1. The hot-patch does not change the underlying release number, so a version check alone cannot prove success. A failed hot-patch should lead to the upgrade path, with a restart as the vendor instructs.

UnrealIRCd says the labeled-response module reports a bundle-specific marker when the hot-patch is installed. The fixed release reports 6.2.7.1 instead. A module showing only its old 5.0 value indicates the hot-patch did not apply. Administrators can inspect remote module status through their authorized IRC operator view.

The vendor also offers an interim network-wide spamfilter protection when every server runs 6.0.4 or newer. It does not fix the other issues in the November 7 release. For unsupported version 5, the vendor describes a separate module-disable workaround that requires a restart. Treat both as temporary measures and document which nodes still need replacement.

What Does the Exploitation Evidence Support?

The strongest evidence is the vendor’s own report of abuse attempts and CISA’s KEV decision. CISA marks ransomware-campaign use as unknown and calls for forensic triage. That does not identify an actor or prove compromise of any particular network. Review local operator actions and server records in context, especially unexpected user removals or network bans.

Brandefense Blackhole counted nine dark-chat posts naming CVE-2026-114713 from August 16 through November 14, 2026. The unit is matching posts, not distinct incidents or victims. A separate GitHub search on November 14 found three public repositories naming the CVE. Repository names alone do not establish working exploit code or exploitation; do not add the two counts together.

After fixing the network, retain the topology list and per-node verification record. It should show whether a node was upgraded or hot-patched, the result of the module check, and the operator who confirmed it. The CISA KEV catalog explainer helps place the federal due date in context.