CISA Flags Exploited UnrealIRCd Flaw CVE-2026-114713 With 8.6 CVSS

Key points

• CVE-2026-114713 affects UnrealIRCd IRC servers and enables command injection at the server level.
• CISA added it to KEV after evidence of active exploitation.
• CVSS score is 8.6; treat exposure as urgent.
• Admins should patch, restrict access, and hunt for compromise.

In November 2026, on a Friday, CISA placed CVE-2026-114713 on its Known Exploited Vulnerabilities list. The entry concerns UnrealIRCd, an IRC server maintained by the UnrealIRCd project, and reflects confirmed attacks rather than a theoretical risk.

The flaw permits an attacker to inject commands that execute at the server level. With a CVSS score of 8.6, it is rated high severity, and the KEV listing makes clear that adversaries are already using it. Any organization exposing an affected IRC service should assume it is a target.

Teams running UnrealIRCd are affected, particularly internet-facing instances used for community, support, or internal chat. Because IRC servers often bridge trusted networks and host sensitive channels, a compromised daemon can become a foothold for lateral movement and data theft.

KEV inclusion is a signal that exploitation is observed, not hypothetical. For K-12 and government environments, unpatched chat infrastructure can sit outside normal web-application monitoring, giving attackers a quiet path into the network. The 8.6 score underscores the technical severity, but active abuse raises operational urgency.

Watch for vendor guidance from the UnrealIRCd project on fixed releases, CISA KEV updates, and signs of unexpected commands, new accounts, or configuration changes on IRC hosts. Treat any exposed instance as compromised until patched and reviewed.

What to do now

1. Inventory every UnrealIRCd instance and version, prioritizing internet-facing IRC services.
2. Apply the fixed release from the UnrealIRCd project; if none is available, isolate the service immediately.
3. Block IRC ports and administrative interfaces from untrusted networks and restrict access to known hosts.
4. Review server logs for command-injection attempts, anomalous commands, new accounts, and configuration changes; preserve evidence.
5. Rotate credentials, API tokens, and TLS keys if compromise is suspected.
6. Segment IRC servers from critical systems and enforce least privilege on the host.
7. Track CISA KEV and vendor advisories, and set an emergency patch SLA for actively exploited flaws.

CVE references

• CVE-2026-114713

Original source

The Hacker News