# UnrealIRCd: ordinary users can issue commands with IRC operator authority Canonical: https://www.oktsec.com/radar/unrealircd-cve-2026-114713 Publisher: Oktsec Language: en Published: 2026-11-14T14:21:38Z Updated: 2026-11-14T14:21:38Z Record reviewed: 2026-11-14T14:21:38Z Latest evidence check: 2026-11-14T14:21:38Z Disclosed: 2026-11-07 The maintainer reports exploitation of a flaw in IRC label handling on networks of linked servers. Correct every affected server; this grants authority within IRC, not an operating system shell. ## Evidence and response priority - Category: Vulnerability - Oktsec priority: Act now - Rationale: The maintainer reports Internet exploitation. Ordinary IRC users can abuse label handling on a network with at least two linked servers; the correction must cover the network. - Evidence: Attacks confirmed - Verification: Vendor confirmed - Fix status: Fix available - Exposure requirement: Application or configuration dependent - Vendor: UnrealIRCd - Products: UnrealIRCd - CVEs: CVE-2026-114713 ## Technical overview The November 7 release fixes nine security issues. CVE-2026-114713 concerns IRC protocol authority: malformed labels can introduce commands into traffic between servers. An ordinary user can consequently perform operations normally reserved for the server or an IRC operator. This is not evidence of arbitrary operating system command execution. The current maintainer notice reports exploitation. The supported hot patch avoids a restart on compatible Unix deployments; Windows operators and administrators whose patch attempt fails should upgrade instead. Check every linked server rather than treating one successful installation as network coverage. Version 5 is also affected and has been unsupported since 2023. The maintainer has not completed equivalent checks for all older branches. Do not interpret their omission from the CVE range as assurance that an obsolete installation is safe. ## Recommended response Upgrade every affected server to 6.2.7.1 and restart, or apply and verify the supported hot patch. Review unexpected operator commands and bans. Relevant to: Administrators of linked IRC networks. ## CVE attribution - CVE-2026-114713: UnrealIRCd — UnrealIRCd. [Source](https://forums.unrealircd.org/viewtopic.php?t=9487) ## Affected systems and fixes ### UnrealIRCd 6 Affected: 6.0.0 through 6.2.7, with labeled-response on networks of at least two linked servers. Fixed release / action: 6.2.7.1; Supported Unix systems: bundle-20261107 on every server; verify the module status. ### UnrealIRCd 5 Affected: The maintainer also identifies version 5 as affected and out of support. Fixed release / action: Migrate to a supported corrected release. Temporary guidance requires disabling labeled-response on every server and restarting; rehashing is insufficient. Confirm the running version against the vendor advisory, including any distribution backports. ## CISA KEV evidence Catalog: 2026.11.13 Checked: 2026-11-14T16:03:56.845Z ### [CVE-2026-114713](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-114713) - Added: 2026-11-13 - Ransomware use: Not confirmed by CISA - Federal due date: 2026-11-16 - Federal forensic triage: Yes Action specified by CISA: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America. ## Supporting evidence Snapshot checked: 2026-11-14T21:07:37.491Z. These dates do not change the incident’s editorial review date. ### FIRST EPSS forecast - [CVE-2026-114713](https://api.first.org/data/v1/epss?cve=CVE-2026-114713): 0.51% probability of observed exploitation in the next 30 days; percentile 43.9%; score date 2026-11-14. EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-11-14T21:07:37.491Z. ## Response checklist 1. **Check the entire linked network** — Record each server version and whether labeled-response is loaded. 2. **Correct and verify each server** — Install 6.2.7.1 and restart. On supported Unix systems, bundle-20261107 is an alternative; check that labeled-response reports the patch bundle or corrected version. Use the upgrade if patching fails. 3. **Respect the workaround limits** — The vendor’s SPAMFILTER workaround only covers the critical flaw when every linked server is at least 6.0.4. It does not fix the other eight issues. 4. **Review earlier IRC activity** — Oktsec recommends preserving logs and checking unexpected KILL, GLINE and other operator actions. Installing a correction does not explain prior activity. ## Relevance to AI environments Inventory all linked servers, including instances maintained by another operator. ## Sources - [Security release, current exploitation warning and verification steps](https://forums.unrealircd.org/viewtopic.php?t=9487) — UnrealIRCd; Vendor notice; checked 2026-11-14T14:21:38Z - [Maintainer announcement on oss-security](https://www.openwall.com/lists/oss-security/2026/11/08/1) — UnrealIRCd maintainer; Vendor notice; checked 2026-11-14T14:21:38Z - [CVE record: linked server prerequisite](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/114xxx/CVE-2026-114713.json) — CVE Program; Vendor notice; checked 2026-11-14T14:21:38Z ## Editorial record - 2026-11-14T14:21:38Z: Added verified scope, correction and evidence limits from primary sources. ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/unrealircd-cve-2026-114713) · [Build a response plan](https://www.oktsec.com/radar/unrealircd-cve-2026-114713#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=unrealircd-cve-2026-114713&service=exposure_check) - [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=unrealircd-cve-2026-114713&service=patch_verification) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.