UnrealIRCd Flaw CVE-2026-114713 Exploited for Command Injection
CISA lists an exploited UnrealIRCd flaw (CVSS 8.6): any user on a network of linked servers can inject commands that run with server privileges.
⚡ Why it matters
Many tech and gaming communities still run IRC servers. If you operate an UnrealIRCd network, this flaw is being exploited now and hands an attacker server-level power over the whole network.
On November 13, 2026, CISA added CVE-2026-114713, a flaw in the UnrealIRCd server, to its Known Exploited Vulnerabilities (KEV) catalog following reports of active exploitation. It carries a CVSS score of 8.6.
What kind of flaw is it?
CISA describes it as an improper neutralization of delimiters issue that lets any user on an IRC network made up of two or more linked servers inject server-to-server commands that are executed with server privileges. In practice, that can mean network-wide control over channels and users.
The agency gave U.S. federal agencies until November 16 to apply the fix.
What to do
- Upgrade UnrealIRCd to the latest release that fixes the flaw, as listed in the project's official announcement.
- Review server-link logs for unusual commands.
- If you can't update right away, temporarily restrict who can connect to the network.
🔗 Sources
This article is original reporting by the Security World editorial team based on the sources listed above; direct quotes are kept short and marked with quotation marks. Corrections and feedback: info [at] securitywd.net.
Related stories
Critical CVEs: Synology, SharePoint, VS Code and Routers
Here are the most important critical vulnerabilities published in the US NVD between November 9 and 15, 2026, from Synology and Microsoft to developer tools, WordPress plugins and old home routers, with what to do for each.
Claude 'Office Party' Skills Flaw Runs Code on Linux
AIR Security disclosed Office Party, a flaw in Claude's official Word, PowerPoint and Excel skills that can run malicious code on Linux once a file is planted in a shared temp folder. Anthropic has chosen not to fix it.
Windows Paint Flaw CVE-2026-83844: Update via the Store
Microsoft patched a remote code execution flaw, `CVE-2026-83844`, in Windows Paint after nearly a month of confusion over the fixed version and its Store availability. The safe version is 11.2609.401.0.