CVE-2026-114713: Exploited Vulnerability in UnrealIRCd Requires Immediate Patching

## Overview CISA added CVE-2026-114713 to its Known Exploited Vulnerabilities (KEV) catalog on November 13, 2026. This move indicates a federal deadline for remediation. The vulnerability affects UnrealIRCd versions 6.0.0 through 6.2.7.1. It allows users on networks with multiple linked servers to inject server-to-server commands. ## Technical Details The vulnerability lies in the labeled-response module of UnrealIRCd. It fails to properly escape the IRCv3 "label" message tag when echoing it in responses. This oversight allows attackers to manipulate server commands. The commands are executed with server authority, which can lead to severe consequences for affected networks. ## Impact The exploitation of CVE-2026-114713 can compromise the integrity of server communications within linked networks. Attackers can gain control over server operations, potentially leading to unauthorized access or disruption of services. Given its CVSS score of 8.6, the risk is significant, and immediate action is necessary. ## Mitigation Defenders should patch UnrealIRCd to version 6.2.7.1 or later as soon as possible. Network administrators must also review their security configurations and monitor for any unusual server activity. Regular updates and security audits can help mitigate future risks.