UnrealIRCd's Worst Bug in 15 Years Is Exploited; CISA Gives Federal Agencies Until 16 November

On 13 November 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added a flaw in UnrealIRCd, the open-source IRC server software, to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The flaw, tracked as CVE-2026-114713 and named the "UnrealIRCd Improper Neutralization of Delimiters Vulnerability" in the catalog entry, had already been patched six days earlier when the project shipped version 6.2.7.1.

UnrealIRCd describes itself as the most widely deployed IRC server, and it is the backbone of many research, hobbyist, open-source and educational chat networks that predate and coexist with modern platforms. The project's own release notes for 6.2.7.1 describe fixing eight security issues on 7 November 2026, one of them rated critical: a bug that "can be abused by any normal user to execute commands with server or IRCOp authority." The notes add that the fixes could be applied through a hot-patch, without restarting the server, except on Windows.

How the flaw worked

The bug sat in UnrealIRCd's labeled-response module, part of its support for the IRCv3 protocol extensions. IRCv3 lets a client attach a "label" tag to a command so the server can echo that label back in its reply, letting the client match requests to responses. According to reporting by The Hacker News, the server copied a client-supplied label into its reply without escaping delimiter characters such as semicolons, spaces or line breaks, which IRC uses to separate commands and tags.

On a network where two or more servers are linked, that meant a logged-in user could craft a label that, once echoed into a server-to-server reply, was parsed by the receiving server as one or more additional commands — commands that carried the authority of the server itself rather than of the ordinary user who sent them. The Hacker News reports that exploitation in the wild began on 8 November 2026, the day after the fix shipped, and that CISA confirmed active exploitation before adding the flaw to the KEV catalog on 13 November 2026. Bram Matthys, known as Syzop, UnrealIRCd's lead developer, told The Hacker News at the time, "We are seeing bad guys exploiting this issue on the internet right now," and described the bug as the most critical the project had found in its 15-year history.

Why it matters beyond one IRC server

IRC networks still carry real weight in open-source development, scientific collaboration and hobbyist communities that rely on self-hosted infrastructure rather than commercial chat platforms, and UnrealIRCd is a common choice for operators running their own servers. Anyone administering such a server, including university or lab networks that still route coordination traffic through IRC, was exposed to privilege escalation until they applied the hot-patch or upgraded to 6.2.7.1.

The vulnerability is also a clean teaching example of delimiter-injection bugs: a value that is safe inside one message field becomes dangerous once it is echoed, unescaped, into a context with its own control characters. The same class of bug recurs in header injection, log injection and command injection across many protocols, which makes CVE-2026-114713 a useful case study for students and engineers learning to reason about where untrusted input crosses a trust boundary rather than just whether it is present.

The CISA deadline and the second flaw added the same day

CISA's catalog entry for CVE-2026-114713 does not, by itself, legally bind anyone outside the US federal government: its direct legal force comes from Binding Operational Directive 26-04, which, per CISA's alert, requires Federal Civilian Executive Branch agencies to prioritize remediation of cataloged vulnerabilities on their networks. In practice, the KEV catalog functions as a widely watched signal of confirmed real-world exploitation that security teams well beyond US federal agencies use to triage patching.

CISA added a second vulnerability to the catalog in the same alert: CVE-2026-123039, described as a "Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability." The two unrelated flaws, in an open-source volunteer project and in commercial enterprise security appliances, landing in the same catalog update underlines that active exploitation this month has not been confined to one type of software or one kind of maintainer.

For anyone running UnrealIRCd 6.0.0 through 6.2.7, the practical step is unchanged regardless of CISA's deadline: apply the hot-patch described in the project's release notes or upgrade to 6.2.7.1 or later, since public exploitation was already under way before the catalog addition made it official.