UnrealIRCd warns users are exploiting flaw to run server commands

UnrealIRCd has disclosed that CVE-2026-114713 is being exploited in the wild, enabling ordinary users to execute commands with server or IRC operator authority. The UnrealIRCd project warned that attackers are actively using the flaw, which affects UnrealIRCd versions before 6.2.7.1.

The vulnerability resides in the labeled-response module and allows a user to inject server-to-server commands by failing to escape the IRCv3 “label” tag when replies are echoed, meaning linked servers will treat those lines as commands with server authority. The CVE record rates the issue at CVSS 8.6 (High, v3) and the project describes it as the most critical UnrealIRCd flaw in the past 15 years. Evidence cited includes the team’s internal audit, the confirmation of live attacks, and a no-restart hot-patch being offered as an immediate mitigation.

To mitigate, UnrealIRCd recommends applying a spamfilter workaround that blocks invalid labels, applying the hot-patch bundle-20261107 across 6.0.0 to 6.2.7, or upgrading to version 6.2.7.1. Affected deployments running UnrealIRCd 5 should blacklist the labeled-response module and move to 6, with the expectation that this vulnerability is exploited in the wild, prompting urgent action. The advisory also notes that UnrealIRCd 6.0.0 through 6.2.7 are impacted, with older releases such as 3.2.x and 4 not checked. Claims are attributed to the UnrealIRCd project and security researchers via SecurityOnline[.]info.