14/11/2026
Critical Web Servers & Runtimes Actively Exploited Vulnerabilities (KEV)
About 2 min read

UnrealIRCd: CISA confirms active exploitation of CVE-2026-114713

CVE-2026-114713

CISA confirms CVE-2026-114713 in UnrealIRCd is being exploited in the wild. A user on a network with at least two linked servers can inject server-to-server commands executed with server privileges. Prioritize mitigations under CISA guidance before the KEV deadline of 2026-11-16.

UnrealIRCd: CISA confirms active exploitation of CVE-2026-114713

At a glance

  • CISA confirms CVE-2026-114713 in UnrealIRCd is being exploited in the wild.
  • A user on a network with at least two linked servers can inject commands executed with server privileges.
  • The KEV remediation deadline is 2026-11-16.
  • Apply vendor and BOD 26-04 mitigations; discontinue use if no mitigation is available.
In this article

CISA confirms active exploitation of a vulnerability in UnrealIRCd. Organizations operating the software should assess each asset’s exposure and follow the response requirements described in the source information.

Overview and technical details

UnrealIRCd is IRC server software used to operate IRC chat networks. CVE-2026-114713 is classified as CWE-140; CISA lists the vulnerability as actively exploited, while its use in a ransomware campaign is unclear.

FieldDetails
ProductUnrealIRCd
VulnerabilityCVE-2026-114713
CWECWE-140
Exploitation statusCISA KEV: exploited in the wild

Affected systems

The described risk applies to a network with two or more linked servers. Any user on such a network can exploit the vulnerability to inject server-to-server commands; the record does not identify affected version branches.

Mechanism and impact

The vulnerability results from improper handling of delimiters. Injected server-to-server commands can execute with server privileges. The record confirms this command-injection capability but does not specify additional impacts.

Exploitation status

CISA lists CVE-2026-114713 in KEV as actively exploited. Whether the vulnerability is used in a ransomware campaign is unclear. The KEV remediation deadline is 2026-11-16.

Remediation and mitigation

  1. Prioritize action under CISA’s BOD 26-04 guidance and assess the Internet exposure of each asset.
  2. Apply mitigations from the vendor and BOD 26-04 guidance, and comply with the Forensics Triage Requirements. For cloud services, apply the corresponding BOD 26-04 guidance.
  3. If no mitigation is available, discontinue use of the product.
References: CISA KEV

Related articles