Warning: Actively exploited CVE-2026-114713 affects UnrealIRCd, Patch Immediately!
UnrealIRCd has released version 6.2.7.1 and an official hot-patch to address 9 security issues, including the critical vulnerability CVE-2026-114713. The maintainer reports active exploitation of this vulnerability.
Exploitation of CVE-2026-114713 would allow an unauthenticated attacker on a network with 2 or more linked IRC servers to inject and execute arbitrary server-to-server commands with full server authority, enabling to modify server configurations, manipulate network state, and compromise the integrity of the IRC infrastructure.
The labeled-response module in UnrealIRCd does not escape the IRCv3 "label" message tag when echoing it into replies. This allows injection of server-to-server commands that are executed with server authority on networks with 2 or more linked servers.
The Centre for Cybersecurity Belgium strongly recommends installing updates for vulnerable devices with the highest priority after thorough testing.
The CCB recommends organizations upscale monitoring and detection capabilities to identify any related suspicious activity and ensure a swift response in case of an intrusion.
In case of an intrusion, you can report an incident via .
While patching appliances or software to the newest version may protect against future exploitation, it does not remediate historic compromise.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
