Type Vulnerability
UnrealIRCd UnrealIRCd contains an improper neutralisation of delimiters vulnerability that allows any user on a network with two or more linked servers to inject server-to-server commands that are… Known-exploited…
UnrealIRCd
UnrealIRCd Improper Neutralization of Delimiters Vulnerability
CVE-2026-114713
What this means
This is rated high severity (8.6 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether UnrealIRCd is in your estate, and treat that as the priority.
Full vendor description
The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when echoing it into replies, which allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority.
Scoring and exploitation
8.6/ 10
CVSS 3.1 base scoreHigh
Exploitable over the network without any account, and no one has to click or open anything. High impact on integrity, and it can reach beyond the vulnerable system.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Exploitability
Longer bar: easier to attack
Attack vectorNetworkAV:N
Attack complexityLowAC:L
Privileges requiredNonePR:N
User interactionNoneUI:N
ScopeChangedS:C
Impact
Longer bar: more harm
ConfidentialityNoneC:N
IntegrityHighI:H
AvailabilityNoneA:N
- ~0.3% estimated chance of attack in 30 daysModel estimate (): a probability signal, not confirmed exploitation
- Exploited in the wild
- Yes — confirmed exploitation (US CISA )
- Not reported
- Listed product
- UnrealIRCd
Weaknesses
CWE-140
References
5 links from the CVE record, grouped by site.
forums.unrealircd.org1 link
unrealircd.org2 links
openwall.com1 link
cisa.gov1 link