CISA Adds Exploited UnrealIRCd Server-Command Injection to KEV

Quick Answer

Patch every linked UnrealIRCd server and verify the loaded module. CISA lists November 16 as the due date and flags forensic triage; review exposure and follow the applicable response timeline.

Last verified: 2026-11-14 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.

Scope And Authority

Product scope	UnrealIRCd linked IRC servers
Advisory	CISA-KEV-CVE-2026-114713
CVE	CVE-2026-114713
Authoritative KEV addition date	2026-11-13 — CISA KEV addition; catalog released at 2026-11-13T20:24:18.3008Z.
Authority revision date	No later KEV revision is recorded. Original vendor disclosure: 2026-11-07T15:00:00Z.
Affected versions	UnrealIRCd 6.0.0 through 6.2.7 and end-of-life UnrealIRCd 5. CISA describes networks with two or more linked servers. Other end-of-life branches have not been assessed by the project.
Fixed version	UnrealIRCd 6.2.7.1, or the supported bundle-20261107 hot patch on compatible UnrealIRCd 6 servers.
CVSS base score	Not provided by the authority
CVSS severity	Critical
Exploitation status	Active exploitation confirmed by the project and CISA; CISA lists ransomware campaign use as Unknown.; no exploitation claim is inferred.

What Changed

CISA added CVE-2026-114713 to KEV on November 13. An ordinary IRC user can inject commands executed with server authority. The project also confirms active exploitation.

What To Validate Now

1. Inventory. Map linked servers, operators, versions, platforms, administrative dependencies and logging coverage.
2. Establish applicability. Verify every linked node; one updated server does not establish that the network is remediated.
3. Remediate. Follow the project workaround first, then hot-patch supported Unix deployments or upgrade and restart into 6.2.7.1. Windows and failed hot patches require upgrading. The spamfilter workaround requires all linked servers to run 6.0.4 or newer and does not fix the other issues.
4. Validate. Verify labeled-response reports 5.0-hot-patch-bundle-20261107 or 6.2.7.1. Retain module output and logs, investigate unexpected privileged IRC actions, and test federation and operator workflows.
5. Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.

Operational Cautions

End-of-life UnrealIRCd 5 needs the project-specific temporary containment and migration to a supported release. Coordinate restarts and preserve evidence. CISA does not publish a CVSS score; Critical is the project severity, and federal directive scope must be assessed separately.

Evidence To Retain

• Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
• UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
• Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.

Related TechGeeks Resources

• TechGeeks Security Notice Center
• All Security Notices

Authoritative References

• UnrealIRCd security announcement
• CISA Known Exploited Vulnerabilities catalog
• CISA November 13 KEV announcement
• CISA BOD 26-04
• CISA BOD 26-04 implementation guidance

Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.