One Label Wasn’t Escaped. The Server Obeyed Anyway.
CISA added a new flaw to its exploited-vulnerabilities list on Friday, and the timeline should make every IRC server operator wince: the fix shipped on November 7, exploitation attempts began the next day, and the listing landed on November 13 with a federal patch deadline of November 16. The flaw is CVE-2026-114713, an 8.6-rated command injection bug in UnrealIRCd, the open-source chat server that still powers IRC networks around the world. Its maintainer calls it the most critical issue found in the software in fifteen years — and says the attackers are already using it.
The bug lives in a small feature with an outsized blast radius. IRCv3 lets clients attach a “label” tag to a message, so replies can be matched to requests. UnrealIRCd’s labeled-response module echoes that label back into its replies — but in versions 6.0.0 through 6.2.7.0, it never escaped the label first. Any user on a network with two or more linked servers could slip server-to-server commands into a label, and the receiving server would run them with server authority. No admin account needed, no special privileges — just a chat message with a poisoned tag, and the server obeyed.
That is what makes this one different from an ordinary chat-server bug. Server authority on an IRC network is close to total control: the ability to issue commands other servers trust, to manipulate channels and users, and to turn one compromised connection into a network-wide problem. The exact goals of the current exploitation are still unknown — CISA’s listing confirms attacks are happening, not what the attackers want — but the maintainer’s warning leaves little room for doubt about the urgency. “We are seeing bad guys exploiting this issue on the internet right now,” Bram Matthys, who goes by Syzop, wrote on the project’s forums. “Hopefully everyone has hot-patched or updated their server, or at the very least has the spamfilter workaround deployed. If not, do so ASAP!”
The fix has been available for a week. UnrealIRCd 6.2.7.1, released November 7, patches CVE-2026-114713 along with several other vulnerabilities the project found with the help of AI. The exploitation began roughly a day after that release — a familiar pattern by now, where the patch announcement itself tells attackers exactly where to look. Federal civilian agencies have until Monday, November 16, to apply it under CISA’s Binding Operational Directive 26-04, a three-day deadline that signals how seriously CISA rates the risk. The flaw joins a busy week for the exploited list: earlier in the month, four actively exploited flaws landed at once, and the same Friday listing also added a Check Point privilege-escalation bug — the zero-day in its Gaia operating system that attackers chained with the PHP2Shell flaws to take over firewalls.
If you run UnrealIRCd, the action list is short. First, upgrade to 6.2.7.1 — that is the fix, and it has been out since November 7. Second, if you cannot upgrade immediately, deploy the spamfilter workaround the project published; it is not a substitute for the patch, but it blocks the injection while you schedule the update. Third, check whether your network links more than one server — the attack needs linked servers to work, so a single standalone server is not exposed the same way, but any network with two or more is. Fourth, look for signs of abuse in your server logs: unexpected server-to-server commands, or label tags carrying anything that is not a plain identifier, deserve investigation now rather than after the next KEV deadline.
IRC is easy to dismiss as a relic, and that is exactly why flaws like this one are dangerous. The networks still running are often maintained by small teams or volunteers, on servers that have not been touched in years, and a bug the maintainer calls the worst in fifteen years does not care how old the protocol is. The patch took a week to become a KEV listing. The attacks took a day. If your server is still on 6.2.7.0 or older, the gap between those two numbers is the only thing that matters.