External risk intelligence

UnrealIRCd Server Command Injection Vulnerability

CVE advisoryKnown Exploit

CVE-2026-114713

UnrealIRCd is an internet-facing server application designed to host public or private IRC networks. Because these services are intentionally exposed to the internet to allow remote client connections and inter-server communication, they represent a commonly internet-reachable service architecture.

Unrealircd

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the UnrealIRCd software could allow unauthorized users to inject commands with server authority. This issue affects the communication between servers on a network and could potentially be leveraged by malicious actors. The main concern is to confirm if this technology is in use and assess its exposure.

Code flaw lets users control servers.
Impacts server-to-server communication.
Confirm use and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted messages to an IRC server. If the IRC network has at least two servers linked together, any user can send a message with a malicious "label" tag. This tag is not properly handled and can be echoed back in a way that allows the attacker to inject commands that will be executed by the server itself, potentially leading to unauthorized server actions.

No authentication required for access.
Triggers by sending a labeled message.
Allows unauthorized server command execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, users on IRC networks with multiple linked servers could inject commands that execute with server authority. This could impact server-to-server communications and potentially disrupt network operations.

IRC server commands.
Injected by unauthenticated users.
Network command execution disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in UnrealIRCd, which allows for server-to-server command injection, is likely to be a concern for teams managing IRC infrastructure, potentially including network administrators, security operations, and application owners responsible for the IRC service. The immediate first step is to identify all instances of the affected UnrealIRCd software, determine their network exposure and criticality, and then coordinate with the accountable owner for remediation planning.

Identify IRC server owners and scope.
Verify server reachability and criticality.
Plan and execute vendor-coordinated updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is UnrealIRCd?

UnrealIRCd is an open-source server application used to host Internet Relay Chat (IRC) networks. It facilitates real-time communication by managing chat rooms and users, and it supports complex architectures where multiple IRC servers are linked together to form a larger, interconnected network.

What is the vulnerability in CVE-2026-114713?

This issue is classified as CWE-140, which refers to improper neutralization of delimiters. In this case, the software fails to properly sanitize or 'escape' the IRCv3 'label' message tag. Because this input is echoed into replies without protection, it allows unauthorized commands to be injected into server-to-server traffic.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending a specially crafted message containing a malicious 'label' tag to an IRC server. This bug only manifests on networks with two or more linked servers, where the server-to-server communication protocol is active. Simply using the software on a single, isolated server without any links does not trigger this specific command injection path.

Is my network relevant to this threat?

If you operate a multi-server IRC network, your infrastructure is at risk. Halo Surface Signal identifies UnrealIRCd as an internet-facing application by design, as it must be reachable to facilitate public or private client connections. Because it is intentionally exposed to the network to function, any linked server configuration running affected versions should be treated as high priority.

How should I respond to CVE-2026-114713?

Begin by auditing your infrastructure to locate all instances of UnrealIRCd. Determine which servers are linked and assess their reachability. Once identified, prioritize these systems for updates based on your organization's internal criticality standards. Coordinate with the teams responsible for these services to schedule and apply the necessary vendor-provided updates to remediate the command injection flaw.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.