UnrealIRCd administrators should prioritize patching CVE-2026-114713, which lets ordinary IRC users send commands with server authority across linked servers. CISA added it to its Known Exploited Vulnerabilities catalog on November 13.
The CVE record identifies a failure to escape the IRCv3 label message tag in the labeled-response module. Networks with at least two linked servers are exposed to injected server-to-server commands. The affected UnrealIRCd 6 range starts at 6.0.0 and ends before 6.2.7.1; the CVSS 3.1 score is 8.6.
The consequence is unauthorized IRC administration, including disconnecting users and imposing network bans. These descriptions concern IRC commands and do not establish operating-system shell execution.
The project’s official advisory reports exploitation on the internet. Its November 8 follow-up says abuse attempts began the day after the security release.
Administrators can upgrade to 6.2.7.1 or apply the official bundle-20261107 hot-patch on supported Unix-like deployments, covering every server. Windows installations should upgrade. Follow the advisory’s verification steps; its immediate spamfilter workaround does not fix the other issues covered by the release.
The project also warns that end-of-life UnrealIRCd 5 is similarly affected. Operators should follow its legacy guidance and migrate to a supported release.
