UnrealIRCd Delimiter Flaw (CVE-2026-114713) Added to CISA KEV, Allows Server-Authority Command Injection

What Happened

CISA added CVE-2026-114713 to its Known Exploited Vulnerabilities (KEV) catalog. This means it is being actively exploited in the wild. The flaw affects UnrealIRCd. It stems from improper neutralization of delimiters in server-to-server protocol handling. According to the vendor's forum advisory, any user on a network with two or more linked UnrealIRCd servers can inject server-to-server commands. Those injected commands execute with server authority rather than ordinary user privileges.

No CVSS score has been published for this vulnerability. CISA currently lists known ransomware use as unknown. Details on exploitation campaigns and actors are not yet available.

Why It Matters

The vulnerability lets any user on one server escalate to server-authority command execution across a linked network. The practical impact is privilege escalation and abuse of server-to-server trust. A user with client-level access to one server in a linked network could affect other servers in that network without operator or admin credentials. Any organization or community running multi-server UnrealIRCd deployments is potentially exposed. KEV inclusion means defenders should treat this as a real-world risk.

What Defenders Should Do Now

• Identify any UnrealIRCd instances in your environment, especially multi-server or linked configurations. Check the vendor forum advisory for patched versions.
• Until patched, restrict who can connect to linked servers. Audit server-link (S2S) authentication and trust configuration.
• Monitor IRC server logs for server-to-server command traffic originating from ordinary client connections. Watch for unexpected link-command sequences or malformed delimiter patterns.
• Watch for unexpected privilege changes, new server links, or configuration changes on IRC infrastructure that administrators did not initiate.
• Treat any internet-facing or loosely trusted IRC network as higher risk until patching is confirmed.

Developing Intel

This is a same-day KEV addition and details are still emerging. There is no published CVSS score yet. Exploitation specifics remain unconfirmed. We will track updates as the vendor and CISA release more information. For the original advisory, see the UnrealIRCd forum post.