HackerFeeds

CyberSecurity News

Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection

The Hacker News
· November 14, 2026
Vulnerabilities

AI summary

A high-severity security flaw in UnrealIRCd, an open-source Internet Relay Chat server, is being actively exploited by attackers. The US Cybersecurity and Infrastructure Security Agency has added this vulnerability to its Known Exploited Vulnerabilities catalog. The flaw allows for server-level command injection due to improper neutralization of delimiters. It has a CVSS score of 8.6, indicating a significant level of severity. This vulnerability is tracked as CVE-2026-114713.

Vulnerabilities mentioned

CVE-2026-114713
HIGH
CVSS 8.6
CISA KEV

The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when echoing it into replies, which allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority.

Read the full article at The Hacker Newsthehackernews.com/2026/11/attackers-exploit-unrealircd-flaw-that.html

This is an AI-generated brief aggregated by HackerFeeds for convenience and grounded in the source’s own summary; the related CVE, threat-group and country data is from HackerFeeds’ own indexes. The original article is the authoritative source — all rights belong to The Hacker News.