CVE-2026-114713 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-11-08

Added to CISA KEV: 2026-11-13 5 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

IMMEDIATE: Upgrade UnrealIRCd to version 6.2.7.1 or later on ALL servers in the IRC network — the vulnerability affects linked server communications, so all nodes must be patched
IMMEDIATE WORKAROUND (if upgrade is not immediately possible): Apply the hot-patch without restart using './unrealircd hot-patch bundle-20261107' — this is the fastest remediation path for production servers
IMMEDIATE WORKAROUND (alternative): Add 'blacklist-module "labeled-response";' to the configuration of ALL linked servers and reload — this disables the vulnerable module but also disables IRCv3 labeled-response functionality for clients
ACTIVE EXPLOITATION WARNING: Review IRC server logs for anomalous server-to-server commands, unexpected channel or user privilege changes, unusual KILL/MODE/OPER commands, or any server-to-server messages containing unusual label values with IRC protocol delimiters (CR, LF, NUL characters)
Check for signs of compromise: unauthorized IRC operator accounts, modified channel modes, unexpected server configuration changes, or evidence of commands executed with server authority that were not initiated by legitimate operators
Audit all linked server configurations and ensure all nodes are running patched versions before re-enabling labeled-response module
Monitor IRC server logs for client connections sending malformed or abnormally long label tags in IRCv3 message tags
If IRC network serves a production or business function, treat this as a critical incident requiring immediate response given confirmed active exploitation
PATCH PRIORITY: CRITICAL — actively exploited, unauthenticated, no user interaction required, server-authority command injection

🔍 Web Intelligence (Kagi · 2026-11-13)

Summary

CVE-2026-114713 is a security vulnerability in the `labeled-response` module of UnrealIRCd, specifically affecting versions 6.0.0 through 6.2.7.0. The flaw arises because the application fails to properly escape the IRCv3 "label" message tag when echoing it into server-to-server replies. This oversight is significant because it allows malicious actors to perform message injection attacks, potentially leading to unauthorized commands or server-state manipulation within an IRC network.

Exploitation

Active Exploitation: The vulnerability has been reported as actively exploited in the wild ^[1].
Threat Actors: While active exploitation is documented, specific threat actor groups or named ransomware campaigns have not been explicitly attributed in public advisories as of November 2026.
Proof-of-Concept/Exploit Tools: Information regarding publicly available proof-of-concept scripts or automated exploit tools is currently limited in standard security databases.
Attack Prerequisites:

- Network Access: The attacker must have access to a network with two or more linked IRC servers ^[1]^[3]. - Authentication: The attack can be initiated by a user on the network; full administrative authentication is not necessarily a prerequisite to trigger the injection ^[1]. - User Interaction: No specific user interaction is required from the victim beyond the attacker’s ability to send malformed labels through the linked server connection.

Affected Products & Patches

Affected Versions: UnrealIRCd versions 6.0.0 up to, but not including, 6.2.7.1 ^[4]^[5].
Patches: A fix is available in UnrealIRCd version 6.2.7.1, and administrators are urged to upgrade immediately ^[1]^[2].
Mitigations: There are no widely recognized workarounds other than updating the software to the patched version.

Impact

Access and Capabilities: Successful exploitation allows an attacker to inject arbitrary data into server-to-server traffic. This can result in unauthorized command execution across the IRC network, potentially allowing an attacker to manipulate server states or impersonate other users/services.
Business Risk: For internet-facing IRC deployments, this vulnerability presents a critical risk, as it allows for the subversion of server-to-server trust boundaries. This can lead to service disruption, unauthorized access to private channels, or the compromise of the IRC network's integrity.

Sources

Actively exploited CVE-2026-114713 affects UnrealIRCd ...
Exploitation of CVE-2026-114713 would allow an unauthenticated attacker on a network with 2 or more linked IRC servers to inject and execute ...
UnrealIRCd · Labeled-response Module | Threat Radar
CVE-2026-114713VulnerabilityPublished 8 Nov 2026 · Source GCVE Database · 0StarRecord decisionShareCopy for ticketCompare · Authoritative record:CVE-2026-114713· High 8.6→ · Not known to be exploited · CVSS 8.6 High →: upgrade to 6.2.7.1 ...
CVE-2026-114713
CVE-2026-114713: The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when echoing it into replies, which allows any user on a network with two or more linked servers to inject server-to-server ...
CVE-2026-114713: UnrealIRCd · Improper Neutralization of Delimiters | Threat Radar
UnrealIRCd versions from 0 up to but not including 6.2.7.1 contain a vulnerability in the labeled-response module where the IRCv3 "label" message tag is not…
CVE Record: CVE-2026-114713
Description. The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when echoing it ...

🔴 CVE-2026-114713