CISA has added CVE-2026-114713, a high-severity delimiter-handling flaw in UnrealIRCd that lets any user on a linked network run server-to-server commands with server authority, to its Known Exploited Vulnerabilities catalog after confirming active exploitation.
What Is It
CVE-2026-114713 is an improper neutralization of delimiters vulnerability (CWE-140) in UnrealIRCd's labeled-response module. According to NVD, the module does not escape the IRCv3 "label" message tag when it echoes the tag back into replies. The affected code is labeled_response_mtag_is_ok() in src/modules/labeled-response.c.
On a network with two or more linked servers, any user can abuse this to inject server-to-server commands, which the network then executes with server authority.
Why It Matters
- Active exploitation confirmed: CISA added the CVE to the KEV catalog on 2026-11-13. CISA's SSVC assessment lists exploitation as "active," automatable as "yes," and technical impact as "total."
- Severity: CVSS 3.1 base score 8.6 (HIGH), vector
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N. It is reachable over the network, needs low attack complexity, and requires no privileges or user interaction. Because the scope is changed, the impact reaches beyond the vulnerable component, and integrity impact is high. - Low barrier: The attacker does not need to be an operator. Any user connected to a multi-server network meets the precondition.
- Ransomware use: KEV lists known ransomware campaign use as "Unknown."
- Forensic triage: KEV flags this entry for forensic triage ("Yes"), which means CISA's Forensics Triage Requirements apply.
What's Vulnerable
- Product: UnrealIRCd
- Component: the labeled-response module
- Versions: the NVD description lists UnrealIRCd 6.0.0 before 6.2.7.1. The NVD affected-versions data marks all versions below 6.2.7.1 as affected.
- Precondition: a network with two or more linked servers
Patch Status
The NVD description puts the vulnerable range below 6.2.7.1, so 6.2.7.1 is the first version outside it. Check the vendor's forum advisory and news page for official upgrade guidance.
CISA's required action is to apply mitigations according to vendor instructions, in line with BOD 26-04 (Prioritizing Security Updates Based on Risk) and CISA's Forensics Triage Requirements. If no mitigations are available, follow the applicable BOD 26-04 guidance for cloud services or stop using the product. Stakeholders must evaluate each asset's internet exposure and follow the BOD 26-04 patching guidelines.
Federal due date: 2026-11-16.
NVD lists the record's status as "Undergoing Analysis."