CISA lists UnrealIRCd delimiter flaw as exploited (CVE-2026-114713)
Original title: CISA KEV: UnrealIRCd Improper Neutralization of Delimiters Vulnerability — UnrealIRCd UnrealIRCd (CVE-2026-114713)
Federal agencies must apply vendor mitigations by November 16, 2026, or discontinue use if none exist.
CISA added CVE-2026-114713 to the Known Exploited Vulnerabilities catalog. The UnrealIRCd flaw lets any user on a network with two or more linked servers inject server-to-server commands that run with server authority. Required action follows vendor instructions and BOD 26-04, including forensics triage. No affected or fixed version is named.
Unconfirmed: Affected and fixed versions are not stated, and ransomware use is unknown.
- The weakness is improper neutralization of delimiters.
- Exploitation requires two or more linked servers.
- Known ransomware campaign use is listed as unknown.
- Stakeholders must also assess each asset’s internet exposure.
Impact: Inject server-to-server commands executed with server authority
| Product | Affected |
|---|---|
| UnrealIRCd | — |
- 1.Apply vendor mitigations and follow CISA BOD 26-04 guidance.
- 2.Complete CISA forensics triage requirements.
- 3.Discontinue use if mitigations are unavailable.
- CVEs
- CVE-2026-114713
- Vendors
- UnrealIRCd
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-114713 | Label tag injection in UnrealIRCd before 6.2.7.1 | 8.6 | <1% | KEVPoC ×2 | KEV |
From the original article
1 min read at cisa.govUnrealIRCd UnrealIRCd contains an improper neutralization of delimiters vulnerability that allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority.
cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.