High-severity UnrealIRCd flaw exploited globally, commands urgent patch

A critical vulnerability in UnrealIRCd, an open-source IRC server, is now being actively exploited by attackers. Tracked as CVE-2026-114713, the flaw allows any user on a network with two or more linked servers to inject server-level commands that execute with full server authority. The UnrealIRCd project leader confirmed exploitation began just one day after a hotfix was released on November 7, 2026.

The vulnerability is described as the most critical issue found in UnrealIRCd over the past 15 years. The U.S. Cybersecurity and Infrastructure Security Agency has added it to its Known Exploited Vulnerabilities catalog, requiring federal agencies to apply fixes by November 16, 2026. All UnrealIRCd administrators must update to version 6.2.7.1 immediately or deploy available workarounds.