HighExploited vuln · 2026-11-14

UnrealIRCd CVE-2026-114713: labeled-response flaw lets any user run server-authority commands, exploited

SockAnalyst · Security+ certified analyst.

What happened

UnrealIRCd's labeled-response module does not escape the IRCv3 'label' message tag when it echoes it into replies. On a network with two or more linked servers, any ordinary user can inject newlines and smuggle server-to-server commands that run with server authority, so a normal user can KILL, GLINE and do other IRCOp-level actions. The maintainer released UnrealIRCd 6.2.7.1 and a no-restart hot-patch (bundle-20261107) on November 7, 2026, fixing this plus eight other issues (crashes, hangs, DoS and a user 'decloak' IP leak), and calls it the most critical UnrealIRCd issue in 15 years. The maintainer later updated the advisory to say attackers are exploiting it. Belgium's CCB rates it CVSS 3.1 8.6 (CWE-140). CISA added it to the KEV catalog on November 13, 2026.

Who's affected

Anyone running UnrealIRCd 6.0.0 through 6.2.7 on a network with two or more linked servers. Single-server networks are not exposed to the server-to-server injection but still need the other eight fixes. End-of-life UnrealIRCd 3.2.x, 4 and 5 get no hot-patch.

✅ Fix / patch

Right now, as an IRCOp, add the maintainer's workaround spamfilter: /SPAMFILTER add -regex T block - Invalid_label ^label=(?![^\r\n;\x20]*\z) (protects linked servers only if all of them run 6.0.4 or newer).
Then on every server run ./unrealircd hot-patch bundle-20261107 (6.0.0 to 6.2.7, no restart), or upgrade to 6.2.7.1 with ./unrealircd upgrade and restart.
Verify: ./unrealircd module-status | grep labeled-response must show 5.0-hot-patch-bundle-20261107 or 6.2.7.1. Plain 5.0 means NOT patched. As an IRCOp, MODULE -all remote.server.name checks linked servers.
Patching does not undo past abuse: review KILL, GLINE/KLINE/ZLINE, SQUIT and config changes since early November that no operator can account for, and remove rogue bans.

🔎 Quick hunt check

No IOCs (IPs, domains or hashes) have been published by the maintainer, CCB or CISA. Hunt for the effect instead: KILL, GLINE/KLINE/ZLINE/SHUN, SQUIT or MODE actions attributed to a server rather than a named IRCOp, bursts of network bans you did not issue, and spamfilter hits on the Invalid_label workaround rule (each hit is a blocked attempt; note the user and source IP). The queries below assume UnrealIRCd log files (ircd.log or JSON logging) are forwarded to your SIEM as syslog or a custom source.

MITRE ATT&CK: T1190, T1531, T1489

IOCs

No IOCs (IPs, domains or hashes) published by the sources yet.

Hunt queries

Starting points built only from published indicators. Field names vary; tune before use.

(index=* (sourcetype=*unrealircd* OR source=*ircd.log* OR source=*unrealircd*)) earliest=-14d
("Invalid_label" OR "label=" OR "Spamfilter" OR "KILL" OR "G-Line" OR "GLINE" OR "K-Line" OR "Z-Line" OR "SHUN" OR "SQUIT")
| eval action=case(searchmatch("Invalid_label"),"blocked_label_injection", searchmatch("SQUIT"),"squit", searchmatch("KILL"),"kill", true(),"ban_or_spamfilter")
| stats count min(_time) as first_seen max(_time) as last_seen values(_raw) as evidence by host, action
| sort - count
// UnrealIRCd CVE-2026-114713: blocked label-tag injection attempts plus KILL/ban/SQUIT activity to reconcile against real IRCOp actions

Syslog
| where TimeGenerated > ago(14d)
| where ProcessName has "unrealircd" or ProcessName has "ircd" or SyslogMessage has "UnrealIRCd"
| where SyslogMessage has_any ("Invalid_label", "label=", "Spamfilter", "KILL", "G-Line", "GLINE", "K-Line", "Z-Line", "SHUN", "SQUIT")
| extend Action = case(SyslogMessage has "Invalid_label", "blocked_label_injection", SyslogMessage has "SQUIT", "squit", SyslogMessage has "KILL", "kill", "ban_or_spamfilter")
| summarize Count=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Evidence=make_set(SyslogMessage, 25) by Computer, Action
| order by Count desc
// UnrealIRCd CVE-2026-114713: blocked label-tag injection attempts plus KILL/ban/SQUIT activity to reconcile against real IRCOp actions

See all hunt queries →

⏱ CISA deadline

CVE-2026-114713CVSS 8.6 High (v3.1, CNA)

Federal due 2026-11-16 · CISA KEV catalog

Sources

Related playbooks

Check Point Gaia CVE-2026-123039: PHP2Shell plus root zero-day exploited on Mobile Access gateways · Exploited vuln · 2026-11-13
Xen Orchestra VSA-2026-062: empty-object login cookie gives attackers admin and root on XCP-ng hosts, exploited in the wild · Exploited vuln · 2026-11-11
Cisco BroadWorks CVE-2026-20320: unauthenticated OCI-P XXE now exploited to steal server keys, added to CISA KEV · Exploited vuln · 2026-11-11

Get the Weekly KEV & Hunt Pack free — plus the daily SOC brief.

Weekly email; daily brief on the website.

Subscribe free

Read the free weekly pack →