UnrealIRCd flaw CVE-2026-114713 is now exploited: update
CISA lists UnrealIRCd flaw CVE-2026-114713 as exploited. Who is affected, how to check one server and where to find the fixed release.
TL;DR: CISA lists CVE-2026-114713 in UnrealIRCd as exploited. On a network with linked servers, any user can make a server run commands meant only for servers. Move to at least 6.2.7.1 and read the vendor's announcement.
What happened
On November 13, 2026, CISA added two entries to its Known Exploited Vulnerabilities catalogue, and one of them is CVE-2026-114713 in UnrealIRCd, the IRC server software. CISA's catalogue entry gives a due date of November 16, 2026 for federal agencies, which tells everyone else how urgent it considers the fix.
NVD describes the cause as a module that echoes a message label back to the client without escaping it. On a network where two or more servers are linked, a normal user can use that to slip in commands that other servers treat as if they came from a trusted server. NVD scores it 8.6 under CVSS v3.1, as assigned by MITRE, and lists the affected versions as from 6.0.0 up to but not including 6.2.7.1. NVD's analysis of the entry was still in progress when we checked.
Am I affected?
You are affected if you run UnrealIRCd in the version range above and your network has more than one linked server. A single standalone server is not described as exposed in the same way. IRC servers often run quietly for years on a spare machine, so look for them on any host that was set up for chat, bots or a community channel. The vendor's announcement is linked from the UnrealIRCd forum thread, and it is the place to confirm the exact fixed release for your installation.
On one machine, ask the server binary for its version:
unrealircd -vIf you installed it from a distribution package, ask the package manager instead, and compare the result with the range above.
How to check with Stackurity
Stackurity keeps a live inventory of installed packages on Linux servers and matches it against advisories and the CISA catalogue every hour. We do not claim it covers UnrealIRCd specifically, and software built from source or copied into place by hand may not appear in the inventory at all. Treat the version check above as the main test for this one, and use Stackurity for the rest of your estate, where a new entry in the catalogue is matched against what is really installed. See how fixes are tracked and confirmed. Start a free trial of Stackurity to see how it works on your own servers.
