CISA Adds UnrealIRCd Flaw to KEV Catalog, Patch by Nov. 16

The Cybersecurity and Infrastructure Security Agency has added CVE-2026-114713, a flaw in the open-source UnrealIRCd server software, to its Known Exploited Vulnerabilities catalog, confirming that the bug is being actively exploited and giving federal civilian agencies until November 16, 2026 — one day after publication of this story — to patch or disconnect affected systems. The vulnerability, formally named the "UnrealIRCd Improper Neutralization of Delimiters Vulnerability," lets any ordinary user on a multi-server UnrealIRCd network inject server-to-server protocol commands that execute with full server authority, effectively letting a regular chat user act like a network operator.

UnrealIRCd is not a mainstream consumer product. It is a free, open-source Internet Relay Chat (IRC) server that system administrators and hobbyist communities run themselves to host chat networks, the same decades-old protocol technology behind services like Libera.Chat and many gaming and open-source project communities. This is not a browser, operating system, or router vulnerability that touches ordinary consumers — it is a server-administration issue for the relatively narrow population of people who operate or help run a self-hosted IRC network built on UnrealIRCd.

What happened: CISA adds CVE-2026-114713 to the KEV catalog

According to CISA's live KEV catalog feed, the UnrealIRCd entry was added on November 13, 2026, with a required action for federal agencies to apply vendor mitigations in line with CISA's Binding Operational Directive (BOD) 26-04 guidance, or to follow the directive's cloud-service guidance and discontinue use of the product if no mitigation is available. The catalog lists the due date as November 16, 2026 — a three-day remediation window, which is standard for vulnerabilities CISA has confirmed are being exploited in the wild rather than merely theoretical.

The KEV catalog exists specifically to flag vulnerabilities with evidence of active exploitation, as opposed to the much larger universe of vulnerabilities that are merely possible to exploit. Its addition here is itself the news: it is CISA's confirmation, not a rumor or researcher claim, that attackers are using this specific flaw against real UnrealIRCd deployments.

What is CVE-2026-114713?

Per the National Vulnerability Database record for CVE-2026-114713, the flaw sits in UnrealIRCd's labeled-response module, which implements the IRCv3 "label" message tag — a feature that lets IRC clients and servers correlate requests with the correct responses. The module fails to escape that label tag properly when echoing it back into protocol replies. Because IRC's server-to-server protocol uses specific delimiter characters to separate commands and parameters, a label value containing those same delimiter characters can be interpreted as the start of a brand-new, attacker-controlled command rather than as inert data — the textbook definition of CWE-140, improper neutralization of delimiters.

NVD's description states that the bug affects UnrealIRCd 6.0.0 up to, but not including, version 6.2.7.1, and credits the fix to that same 6.2.7.1 release. UnrealIRCd's own project news page, which announced the 6.2.7.1 release on November 7, 2026, independently confirms the fixed version and describes the flaw as allowing "normal users to execute commands with server/IRCOp authority" — language that matches CISA's KEV short description almost exactly.

How the exploit works, in plain terms

To understand the risk, it helps to know that UnrealIRCd networks are often built from multiple linked servers that trust each other's traffic implicitly, the way a company's internal network segments might trust each other more than they trust the open internet. The server-to-server link between those machines uses its own text-based protocol, with specific characters acting as delimiters between one command and the next.

The IRCv3 "label" tag is ordinarily just a short token a client attaches to a message so it can match up the server's eventual reply. CVE-2026-114713 exists because UnrealIRCd's labeled-response code echoes that label value back into a server-to-server reply without stripping or escaping the protocol's own delimiter characters. A malicious or compromised client can set a label value that is itself a full, well-formed server command. When the server dutifully echoes that "label" into the inter-server stream, the receiving server parses it not as a harmless tag but as a new, independent command — one that runs with the authority of the issuing server rather than the authority of the low-privileged user who triggered it.

That is the core of the "privilege elevation via protocol confusion" pattern common to delimiter-injection bugs, and it is why CISA's summary specifically calls out networks with "two or more linked servers": a single, standalone UnrealIRCd instance with no server links has no server-to-server stream for the injected command to reach, which narrows — but does not eliminate — real-world exposure.

Who is actually at risk

This is the point where consumer-security framing breaks down, and it is worth being precise about it rather than overselling the threat. CVE-2026-114713 does not affect anyone's phone, browser, email account, or everyday software. The realistic population exposed to this flaw is administrators who:

• Run a self-hosted UnrealIRCd deployment, most commonly version 6.0.x through 6.2.7;
• Operate a network of two or more servers linked together, which is typical for larger or redundant IRC communities but not for a single small test server;
• Allow ordinary, unprivileged users to connect and send messages — which is to say, essentially any public-facing IRC network.

Federal civilian agencies that happen to run UnrealIRCd internally are bound by the November 16 KEV deadline under BOD 26-04 regardless of how niche the software is within their environment; that directive applies uniformly once a vulnerability is catalogued, not just to widely deployed consumer software. Private network operators — gaming communities, open-source project chat rooms, and hobbyist IRC networks — are not legally bound by the federal deadline but face the same practical exploitation risk CISA is flagging, and arguably more urgency, since they may lack the patch-management tooling federal agencies are required to maintain.

Severity: CVSS score and CISA's exploitation assessment

NVD's record lists a CVSS v3.1 base score of 8.6, rated High, with the vector AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N. In plain language: the flaw is remotely exploitable over the network, requires low attack complexity, needs no special privileges or user interaction, and its "scope changed" designation reflects that a low-privileged chat user can affect a security scope beyond their own — namely, server-to-server trust. The impact is scored as high integrity impact with no direct confidentiality or availability impact, consistent with a command-injection bug whose danger is unauthorized command execution rather than data theft or denial of service by itself.

Separately, NVD's record carries a Stakeholder-Specific Vulnerability Categorization (SSVC) assessment from CISA that marks exploitation status as "active," the exploit as "automatable," and the technical impact as "total" — CISA's own framework for deciding which bugs belong in the KEV catalog in the first place. UnrealIRCd's own advisory rates the bug as critical for its ecosystem, a reminder that a project's internal severity rating and a standardized CVSS score do not always land in the same tier, even when both are describing the same underlying bug.

Vulnerability at a glance

The Nov. 16 deadline and BOD 26-04

CISA's Binding Operational Directive 26-04 governs how federal civilian executive branch agencies must prioritize and act on vulnerabilities once they are added to the KEV catalog, replacing the agency's earlier catalog-remediation directive with a risk-based timeline framework. The directive's implementation guidance spells out the specific forensic-triage and remediation steps agencies must follow, and CISA's required action for this entry points agencies directly to both documents rather than prescribing a generic "patch it" instruction.

Because CVE-2026-114713 was added on November 13 with a due date of November 16, agencies have only a three-day window — far shorter than the standard timelines KEV additions often carry — which signals that CISA considers the active-exploitation evidence here urgent rather than theoretical. Agencies that cannot apply the vendor's fix in time are directed, per BOD 26-04's cloud-service guidance, to discontinue use of the affected product rather than leave it exposed past the deadline. Pandromeda has covered this same directive's practical effect on other recent KEV entries, including a recent OpenSSH flaw added to the catalog and a Check Point Gaia privilege-escalation bug, both of which carried similarly tight remediation clocks.

How to patch and mitigate

UnrealIRCd's own project news confirms that the fix shipped as version 6.2.7.1 on November 7, 2026, alongside a hot-patch mechanism that the vendor says almost all UnrealIRCd 6 networks can apply without restarting the server — a meaningful detail for network operators who want to close the hole without taking a community-facing chat network offline. The recommended steps, drawn from the vendor's own release announcement and advisory thread, are:

• Upgrade to UnrealIRCd 6.2.7.1 or later as the complete, permanent fix.
• Apply the vendor's hot-patch if an immediate full upgrade is not feasible; the vendor states this does not require a server restart on most 6.x deployments.
• Audit server links to confirm which linked servers and operators are trusted, since the flaw specifically abuses server-to-server trust relationships.
• Retire UnrealIRCd 5.x if still in use. That branch reached end of life in mid-2023 and does not receive this fix, so networks still running it should migrate to a supported 6.x release.
• Consult the vendor's advisory thread on the official UnrealIRCd forums for any network-specific workarounds the project posts as the situation develops.

Administrators who have already patched other recent server software, such as the fixes detailed in Pandromeda's coverage of two Barracuda Networks flaws added to the KEV catalog, will recognize the pattern: confirm the exact version in production, apply the vendor's official build, and treat the CISA deadline as a floor, not a ceiling, for how quickly to act.

UnrealIRCd's other fixes and the wider IRC context

The 6.2.7.1 release that fixes CVE-2026-114713 was not a single-issue patch. UnrealIRCd's news announcement describes it as resolving nine security issues in total, spanning this command-injection bug alongside separate crash, hang, denial-of-service, and information-disclosure fixes — including one issue the project describes as letting ordinary users reveal another user's IP address. That breadth is a reminder that KEV entries typically single out the one flaw with confirmed exploitation evidence, even when a vendor's release addresses a larger batch of problems at once.

IRC itself, the protocol UnrealIRCd implements, predates the modern web and remains in active use by open-source project communities, gaming groups, and some larger public networks; Wikipedia's overview of Internet Relay Chat traces the protocol's history for readers unfamiliar with it. UnrealIRCd is one of several open-source server implementations of that protocol, distinct from the networks (like Libera.Chat or EFnet) that run on top of it — a distinction worth keeping in mind, since this vulnerability is in the server software itself and could in principle affect any network operator running the affected code, not any one specific public chat community.

What's next

For federal agencies, the next fixed point is November 16, 2026 — the BOD 26-04 deadline on this entry — after which CISA's compliance reporting treats any unpatched, internet-facing instance as a directive violation. For everyone else running UnrealIRCd, the practical timeline is simpler: the fix has existed since November 7, a hot-patch option exists for networks that cannot take immediate downtime, and CISA has now confirmed exploitation is happening, which removes any ambiguity about whether this is a "patch eventually" or "patch now" situation. Network operators who have not yet checked their version should treat this as the trigger to do so today, verify they are on 6.2.7.1 or later, and review their server-link trust configuration as a secondary hardening step regardless of patch status. CISA's KEV catalog and the UnrealIRCd advisory thread are both likely to be updated if new exploitation details or additional workarounds emerge, and administrators should check both before the week is out.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage