CISA lists UnrealIRCd CVE-2026-114713 as exploited 6 days after the fix; vendor says critical, CVE says 8.6

6 days 5 hours from the fix to the catalog, and what that span does not show

The UnrealIRCd project released version 6.2.7.1 and a hot-patch called bundle-20261107 on Saturday 7 November 2026 at 15:00 UTC; its pre-announcement of 4 November had named that hour ("On Sat 7 November 2026 at 15:00 UTC we will release UnrealIRCd 6.2.7.1"). CISA's Known Exploited Vulnerabilities (KEV) catalog file of 13 November 2026 carries a release stamp of 20:24:18 UTC and lists CVE-2026-114713 as "UnrealIRCd Improper Neutralization of Delimiters Vulnerability". The span from the fix to that catalog release is 6 days 5 hours 24 minutes (derived: 7 November 15:00:00 to 13 November 20:24:18 UTC is 149 hours 24 minutes 18 seconds). The entry's due date, 16 November 2026, is 3 days after its date added and 9 days after the release date (derived).

What the span does not establish. It runs from the fix to the release of CISA's file, not from the first attack. The entry carries a date added, 13 November, and no time; the 20:24:18 UTC stamp belongs to the whole catalog file, and this site's saved copy holds only this entry. None of the saved pages gives a first exploitation date, a victim, an actor or a count. The ransomware field reads "Unknown", which says only that CISA lists no known ransomware use; what else it means is not stated.

Three records describe the same bug and do not match. The vendor's advisory calls it CRITICAL and "the most critical issue found in UnrealIRCd in the past 15 years". The CVE record carries a CVSS 3.1 vector that works out to 8.6, which the record itself labels HIGH. The KEV entry prints no score at all. This briefing sets them side by side and resolves nothing.

UnrealIRCd is the maintainer's own project, and its advisory is his own account of the bug, the fix and how it was found. The vendor's homepage also claims "serving thousands of networks since 1999" and a "market share of 38%", figures this site could not check. The advisory's closing section argues that AI assisted probing is a real danger; that is the maintainer's view, set out below, and not a finding.

What the records agree on

All four saved records carry the identifier. The advisory, the CVE record and the NVD copy agree on 6.2.7.1 as the fixed release (the CVE record says the affected range ends before it; the advisory says to upgrade to it) and on the hot-patch command; the KEV entry names no version or command and points to the vendor's instructions. The CVE record names the module labeled-response, the file src/modules/labeled-response.c and the routine labeled_response_mtag_is_ok(). The advisory calls it "an escaping bug in UnrealIRCd's implementation of the IRCv3" label message tag. The weakness label, CWE-140, is the same in the CVE record and the KEV entry. The fixed version in the advisory matches the CVE record's range end, 6.2.7.1; this site could not check it against the vendor's release notes, which sit on the unread forum host.

Zoom

The mechanism, in the words of the two texts: the module "does not escape" the IRCv3 label message tag when echoing it into replies, so a user can "inject server-to-server commands that are executed with server authority". The advisory describes the bug in prose only, and this briefing adds nothing to that prose.

The three records side by side

The grid shows the four rows on which the records part: severity, versions, what it takes, and what is exploited. Amber cells differ from their neighbours, red cells say nothing on the point, and blue cells agree. The sections that follow take each row in turn.

Zoom

The dates, in the order the saved pages give them

Times are in UTC, converted where a page prints another zone: the vendor's posts are stamped CET, the advisory header says +0100, and NVD prints times with no zone, which this site reads as UTC. The 9 November point in the diagram is a relay: secondary reports, found by search and not saved, are said to claim that the vendor warned of attacks that day. No saved page contains such a notice, so it is drawn as not read.

Zoom

Two details in the dates are worth stating. First, the CISA coordinator's stamp reads exactly midnight on 12 November, so it looks like a date rather than a time of observation (this site's inference); it falls a day before the KEV entry. Second, the CVE record's last update on 14 November matches, to the millisecond, the date of the CISA container inside it, while the container written by the CVE's own assigner still carries its 8 November date. The later changes therefore appear to be CISA's container (inference: the record does not say what changed).

A third mismatch is on the vendor's side. Its newest news post, stamped 14 November 2026, 13:30 CET, has the title "UnrealIRCd 6.2.6-rc1 available for testing" while its text says "the Release Candidate for 6.2.8 is now available for testing" and that the webpanel, a separate project, has a security update. The same title appears on the news index against 20 June 2026. The excerpt does not name CVE-2026-114713, and this site does not say whether the post concerns it.

Severity: CRITICAL, 8.6 HIGH and a coordinator's total

The vendor's word is CRITICAL, in capitals, in the advisory and in the title of its release post; the pre-announcement says "one issue rated as CRITICAL" without naming a scale. No saved vendor page prints a score or a vector. The only CVSS vector sits in the CVE record, in the container written by the CVE's assigner, MITRE; the record names a request form as its generator and not a scorer, so who worked out the vector is not stated. NVD copies it with the source cve@mitre.org and the type "Secondary", shows no score of its own and gives the status "Undergoing Analysis".

Re-computing the CVSS 3.1 base score from the printed vector gives 8.6, with sub-scores of 3.9 for exploitability and 4.0 for impact, the same as NVD prints (derived: impact 7.52 x (0.56 - 0.029) - 3.25 x (0.56 - 0.02) to the power 15 is 3.99; exploitability 8.22 x 0.85 x 0.77 x 0.85 x 0.85 is 3.89; 1.08 x (3.99 + 3.89) is 8.51, rounded up to 8.6). The 8.6 is consistent with its vector. The open question is the vector.

The vector rates confidentiality and availability at none and integrity at high. The advisory's own examples of what a user could do are "any ordinary user can KILL, GLINE, and do many more bad things", and the CISA coordinator's stamp reads technical impact "total". These are different instruments (SSVC is a separate decision method, not a CVSS score; that is general background, not something the saved pages define), and the saved pages do not reconcile them. This site does not rescore the bug.

On the words, a score of 9.0 or higher would be called CRITICAL in the CVSS 3.1 scale (general background on the standard, not stated by the saved pages); the record labels 8.6 as HIGH. The advisory's superlative is a comparison with the project's own history, which the saved pages cannot confirm or test.

Versions: 6.0.0, version 0 and UnrealIRCd 5

The two version statements in the CVE record differ in a small way: the text says 6.0.0, the structured range starts at version 0. A tool that reads only the structured range or the CPE range would match every release before 6.2.7.1, including version 5 and older (inference). That happens to agree with the advisory about version 5, but the CVE record's text does not list it, and the advisory says other end of life versions were not checked.

The advisory goes further on old releases: "It is likely that several bugs that are fixed in 6.2.7.1 go all the way back to 3.2.x". That sentence is about the nine fixed issues as a group, not about the critical one. The advisory's verdict on end of life software is blunt: "Nobody should be running this version" of version 5, and for any end of life release "You are not safe at all". The CVE record and the KEV entry do not carry either statement.

What it takes to exploit it: two linked servers, or any server

The CVE record, and the KEV description that repeats it, say the flaw lets "any user on a network with two or more linked servers" inject commands. The advisory says "Any user can inject newlines" into server-to-server traffic and does not give a minimum number of servers. Its step 1 speaks of "all linked servers" and its patch step says to run the command "on every UnrealIRCd server".

So the saved pages do not settle whether a network with a single server is exposed to this bug. The CVE words imply that it is not; the advisory is silent; this site does not conclude either way. The same release also fixes eight other issues the advisory lists, among them a way to reveal another user's IP address; whether each of those needs linked servers is not stated.

The workaround: a spamfilter rule or a module blacklist

The workarounds are different mechanisms. The advisory leads with a spamfilter rule for version 6 and keeps the module blacklist for version 5; the CVE record gives only the module blacklist. Neither page says what blacklisting the module costs a network, or whether any client feature stops working. The commands are printed exactly in the section on what the advisory prints for administrators.

What the word exploited rests on

Two CISA artefacts carry the idea, not one: the KEV entry, and a CISA container inside the CVE record that NVD copies. Neither prints a report. The table lists every saved page and what it says about exploitation.

The KEV entry's required action tells stakeholders to apply mitigations and names BOD 26-04 and CISA's forensic triage requirements. It adds that "evaluating each asset's internet exposure" is the stakeholders' job. This site did not read the directive or the triage page, and the entry does not say whom the due date binds. As general background, binding operational directives are issued to US federal civilian agencies; that is not stated by the saved pages.

None of this shows the entry is wrong. A catalog entry and a CISA stamp are a government judgment that the saved pages cannot let a reader audit. What the pages allow is the narrower statement: CISA lists it, CISA's container says exploitation is active, and no saved page says who, where, how often or since when.

Labels that do the work of evidence

Known exploited. The catalog's name asserts exploitation; the entry prints no evidence. The saved pages do not say what evidence CISA holds, and this site did not read CISA's catalog criteria.

CRITICAL. A capitalised word on no printed scale, set against an 8.6 that the record itself calls HIGH.

All should be good now. The hot-patch prints a success line, and the advisory itself adds that "you still want to verify that you are really patched". The installer's message is not the check.

Protection right away. Step 1 "gives you some protection right away", but only on networks where every server runs 6.0.4 or newer, and it leaves the other eight issues open.

The AI remarks: what the advisory says and what it leaves out

The advisory opens by saying that during an internal audit, "with the help of AI", several important security issues were found. Its last section says the maintainer has spent "about 100 hours with AI" on audits since February 2026, and that "things have been wild" in the last month. It does not name a tool or a vendor, and it does not say which of the nine fixed issues were found that way. A reading of the text is that the critical issue was among them, but the advisory does not say it outright.

The closing argument is the maintainer's opinion about his own project and about other servers: "nobody has been poking at that daemon with AI" where a network daemon has had no major security fix for a couple of months, "Or some bad guy did but did not report back". The saved pages give no evidence for the second half, and this site treats it as a view, not a finding. What the pages do establish is narrower: a maintainer reports finding nine issues, one rated critical, and shipping a fix and a hot-patch together.

What the advisory prints for administrators

The advisory prints the commands below. They are copied exactly from the maintainer's text version of the advisory and from the CVE record, read on 14 November 2026. This site ran none of them, adds nothing to them, and prints no exploit string: the saved pages publish no indicator, no log line and no detection rule for abuse, only these fixes and checks. Copy from the advisory itself rather than from this page where you can.

Step 1, the spamfilter line. The advisory says to run it as an IRCOp on the network before anything else. It says the line protects all linked servers against the critical issue "only if all your servers are on 6.0.4 or newer" and that the other eight issues still need the patch or the upgrade. It does not explain the pattern, and this site does not interpret it.

SPAMFILTER add -regex T block - Invalid_label ^label=(?![^\r\n;\x20]*\z)

Step 2a, the hot-patch. Run it on every UnrealIRCd server; the advisory says it works on 6.0.0 to 6.2.7, and on Windows or where it fails to use the upgrade. It says the last line on screen should be one of the two below, the second for older versions.

./unrealircd hot-patch bundle-20261107

Patch installed and server rehashed correctly. All should be good now!
Done! All should be good now

Verification. The advisory says to check that the patch really took, on 6.0.2 and later, with the command below, and then to read the output as follows.

./unrealircd module-status|grep labeled-response

The IRC method. As an IRCOp, the advisory says to run the first line below and search the output for labeled-response, and that a remote server can be checked with the second; remote.server.name stands for that server's name.

MODULE -all
MODULE -all remote.server.name

Step 2b, the upgrade. The advisory says to run the command below on a Unix like system and then restart the server; Windows users and others can download 6.2.7.1 from the vendor's site.

./unrealircd upgrade

The configuration workaround. The CVE record says to add the line below to the configuration file of all servers until the patch or upgrade is applied. The advisory gives the same line for version 5 only, and says to add it on all servers "AND restarting them (NOT rehash)".

blacklist-module "labeled-response";

What the pages state, and what they do not

What to do, in order

The question the records leave open

CISA lists the flaw as exploited, the vendor calls it critical and the CVE record scores it 8.6, but will anyone publish what was actually seen, on how many networks and since when?

Key facts