UnrealIRCd Improper Neutralization of Delimiters Vulnerability
UnrealIRCd — UnrealIRCd
- Added to KEV catalog
- 13 November 2026
- Federal remediation due date
- 16 November 2026
- Weakness classification (CWE)
- CWE-140
AI Breakdown
What it is
CVE-2026-114713 is a security vulnerability in UnrealIRCd resulting from improper neutralization of delimiters. In networks configured with two or more linked servers, any regular user can exploit this flaw to inject server-to-server commands. These injected commands execute directly with elevated server authority.
Why it matters
This flaw presents a severe risk because standard users can manipulate linked server communication to gain administrative control. CISA has catalogued this vulnerability due to active exploitation, setting a federal compliance deadline of November 16, 2026. Although use in ransomware campaigns is currently unknown, unmitigated instances expose entire chat networks to compromise.
Recommended action
IT teams must immediately evaluate asset internet exposure and apply vendor mitigations in alignment with CISA BOD 26-04 and Forensics Triage Requirements. For cloud deployments or environments where mitigations are unavailable, administrators should isolate or discontinue using the affected UnrealIRCd product.
AI-generated from CISA and NVD data — treat as a starting point, not a substitute for your own risk assessment.
CISA Description
UnrealIRCd UnrealIRCd contains an improper neutralization of delimiters vulnerability that allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority.
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes
https://forums.unrealircd.org/viewtopic.php?t=9487 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-114713
Is this vulnerability present in your environment?
CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.
Explore VAPT Services