Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoChighExploited in the wild

UnrealIRCd label-tag flaw exploited; agencies must patch by November 16

3 sources · 3 articlesFirst reported Updated ()
What's new

November 14: The Hacker News reports CVSS 8.6, affected versions 6.0.0 before 6.2.7.1, and Matthys saying exploitation began a day after the November 7 hotfix, with attack goals unknown.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Agencies must mitigate exploited UnrealIRCd CVE-2026-114713, fixed in 6.2.7.1, by November 16.

UnrealIRCd released 6.2.7.1 and a hot-patch on November 7, 2026, for CVE-2026-114713, an escaping bug in the IRCv3 label message tag. The Hacker News reports versions 6.0.0 before 6.2.7.1 are affected, the score is 8.6, and a user on two or more linked servers can inject commands that run with server or IRCOp authority. oss-security describes any user injecting newlines into server traffic. CISA added the flaw to its Known Exploited Vulnerabilities catalog and set a November 16, 2026, deadline for federal agencies under BOD 26-04, or discontinuation if mitigations are unavailable. According to maintainer Bram Matthys, exploitation attempts began a day after the hotfix; attack details, goals, and ransomware use remain unknown.

Key facts
  • Fixed release is UnrealIRCd 6.2.7.1; hot-patch issued November 7, 2026.
  • The Hacker News says 6.0.0 before 6.2.7.1 is affected, CVSS 8.6.
  • CISA KEV deadline for federal agencies is November 16, 2026.
  • Exploitation needs two or more linked servers, CISA and The Hacker News say.
  • Matthys called it the most critical UnrealIRCd issue in 15 years.
  • Known ransomware campaign use is listed as unknown.
Analyze CVE-2026-114713 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Nov 7, 2026UnrealIRCd 6.2.7.1 and hot-patch released · oss-security
  2. Nov 8, 2026Exploitation attempts began a day after the hotfix · The Hacker News
  3. Nov 13, 2026CISA adds CVE-2026-114713 to the KEV catalog · CISA Known Exploited Vulnerabilities
  4. Nov 16, 2026Federal agencies must mitigate or discontinue use · CISA Known Exploited Vulnerabilities

What each outlet adds

beyond the shared facts
  • oss-securityReports the November 7 hot-patch and newline injection into server traffic.
  • CISA Known Exploited VulnerabilitiesKEV listing, unknown ransomware use, and BOD 26-04 deadline.
  • The Hacker NewsCVSS 8.6, version range, and Matthys exploitation comments.
CVEs
CVE-2026-114713
Vendors
UnrealIRCd
Organizations
CISA

Coverage

oldest first · one row per article · UTC
  1. · 6d ago oss-securityFirst report

    UnrealIRCd 6.2.7.1 released with hot-patch for label tag escaping bug (CVE-2026-114713)

    The escaping bug allows injecting arbitrary commands into IRC server traffic using the label message tag.

  2. · 1d ago CISA Known Exploited Vulnerabilities

    CISA lists UnrealIRCd delimiter flaw as exploited (CVE-2026-114713)

    Federal agencies must apply vendor mitigations by November 16, 2026, or discontinue use if none exist.

  3. · 40m ago The Hacker News

    Attackers exploit UnrealIRCd flaw enabling server-level command injection

    CVE-2026-114713 in UnrealIRCd 6.0.0 before 6.2.7.1 lets linked-network users inject server commands; US agencies must patch by November 16.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-114713
Label tag injection in UnrealIRCd before 6.2.7.1
8.6<1%KEVPoC ×2
KEV