FCEB

CISA Adds UnrealIRCd CVE-2026-114713 to KEV Catalog Following Active Exploitation

The U.S. Cybersecurity and Infrastructure Security Agency has added a high-severity flaw in UnrealIRCd to its Known Exploited Vulnerabilities catalog after reports confirmed active exploitation in the wild. Tracked as CVE-2026-114713 with a CVSS score of 8.6, the issue stems from improper neutralization of delimiters in the labeled-response module, allowing any user on a network with linked servers to inject server-to-server commands executed with full server authority. The vulnerability affects UnrealIRCd versions 6.0.0 through 6.2.7 and was discovered with the assistance of artificial intelligence during a security review. Project maintainer Bram Matthys released version 6.2.7.1 on November 7, 2026, to address the flaw along with other issues, describing it as the most critical problem found in the project over the past 15 years. Exploitation attempts began the day after the hotfix release, though the exact goals of the observed malicious activity remain unknown. Federal Civilian Executive Branch agencies must apply patches by November 16, 2026, under Binding Operational Directive 26-04.