Security AlertCritical
CISA flags UnrealIRCd flaw after reports of active exploitation
Nov 14, 2026 · Summarized by Fundy Tech from The Hacker News
The 30-second version
CISA has added an UnrealIRCd flaw to its exploited-vulnerabilities list after active attacks were reported. The issue was fixed in version 6.2.7.1.
Key points
- CVE-2026-114713 affects UnrealIRCd before 6.2.7.1.
- The flaw can execute commands with server or IRCOp privileges.
- Exploitation attempts began after the November 7 hotfix release.
Why it matters
If you run an IRC server, attackers may be able to issue commands with server authority. Updating quickly reduces the chance of compromise and service abuse.
Who’s affected: UnrealIRCd servers
What to do
- Update UnrealIRCd to 6.2.7.1 or later.
- Apply the spamfilter workaround if you cannot update right away.
- Check whether your server is in CISA’s KEV catalog.
Vulnerability IDs
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.