VulnSocial

CVE-2026-114713

LOWCVSS 8.6 · HIGH

Signal is active with 3 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when echoing it into replies, which allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-140

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 4 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Peaked at 3 mentions on most recent observed day (2026-11-08)
  • 4 total mentions across 2 days

Deep dive

Activity timeline4 mentions / 2d
01223Mentions · 2026-11-07: 1Mentions · 2026-11-08: 311-0711-08
Referenced assets4 URLs
Full discourse4 posts
  • !Manan@0xManan

    UnrealIRCd <6.2.7.1: any user on a multi-server network injects S2S commands via unescaped IRCv3 label tag CVE-2026-114713 · labeled-response module echoes label without sanitization → reply stream treated as server protocol → KILL/GLINE/etc with full server authority “Most critical issue in 15 years” per project (AI-assisted internal audit) Hot-patch available (no restart on 6.2.x): ./unrealircd hot-patch bundle-20261107 Full: https://www.unrealircd.org/ + http://forums.unrealircd.org/viewtopic.php?t=9487 #UnrealIRCd #IRC #CVE #S2S

    20040441
    2.4K followersView on X
  • UnrealIRCd@Unreal_IRCd

    UnrealIRCd 6.2.7.1 and hot-patch released: this fixes 9 security issues, including 1 CRITICAL (CVE-2026-114713). We suggest first deploying the SPAMFILTER workaround and then running the hot-patch command. See https://forums.unrealircd.org/viewtopic.php?t=9487 for all details. #IRC

    10030110
    313 followersView on X
  • UnrealIRCd@Unreal_IRCd

    ⚠️ We are now seeing attempts by bad guys to actively exploit CVE-2026-114713 in UnrealIRCd on the internet. If you have not hot-patched or upgraded, do so ASAP! #IRC

    0000021
    313 followersView on X
  • Read the Diff@read__the__diff

    https://pwn.watch/i/unrealircd-6-2-7-1-labeled-response-ircop-command-cve-2026-114713

    0000037
    663 followersView on X

Explore more

Back to dashboard