UnrealIRCd flaw that hands users IRCOp powers is now exploited

UnrealIRCd flaw that hands users IRCOp powers is now exploited

13 November 2026: CVE-2026-114713, a critical flaw in the UnrealIRCd IRC server that lets any ordinary user run commands with server or IRCOp authority, is now on CISA's list of exploited vulnerabilities. UnrealIRCd fixed it in 6.2.7.1, released on 7 November 2026, and also offers a hot-patch that fixes a running UnrealIRCd 6 server without a restart, except on Windows.

Not yet independently verified. The project's security advisory on its forum would not load for us, so the affected version range, the CVSS score of 8.6 and CISA's 16 November due date come from one press report (Security Affairs). CISA does not say who is exploiting the flaw. We will update this when it can be confirmed, and remove this note.

Any user can act as an operator

The project's release notes put it plainly: the bug "can be abused by any normal user to execute commands with server or IRCOp authority. This means any ordinary user can KILL, GLINE, and do many more bad things." An attacker needs nothing more than a normal connection to the network. With operator authority they can disconnect users, ban whole address ranges, and use whatever other commands the network grants its operators.

CISA's catalogue entry describes the flaw as improper neutralisation of delimiters. Security Affairs, reporting the addition, gives a CVSS score of 8.6, an affected range from 6.0.0 up to but not including 6.2.7.1, and a due date of 16 November for US federal agencies.

Eight more fixes in the same release

6.2.7.1 is a security release, and the critical bug is one of nine fixes. The others, as the release notes list them:

• a normal user could "decloak" another user and reveal the victim's IP address;
• a second leak of a user's IP address;
• a blacklist recheck could hang the server;
• a crash on CHGIDENT from Services, which a normal user can trigger;
• a counting error that could show "This server is full" to every new connection until restart;
• a cap on the number of bans Services can set, at twice set::maxbans;
• a potential flood issue with TLS renegotiations.

The project says all of these were found in an extensive internal audit carried out with the help of AI.

Patching a network without downtime

For most networks the hot-patch is the quickest route, since it fixes the critical bug and the others in place on UnrealIRCd 6. Windows servers need the full 6.2.7.1 upgrade and a restart. Networks still on the older UnrealIRCd 5 line are not covered by these notes and should check the project's advisory before assuming they are safe.

Because exploitation needs only a user connection, logs are the place to look: operator-level commands such as KILL and GLINE issued by connections that are not opered are the obvious sign, along with unexpected bans set since late October. CISA added the flaw on the same day as a Check Point flaw already covered here, and gives no detail on the attacks.

Sources

• CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog, 13 November 2026
• UnrealIRCd: release notes, UnrealIRCd 6.2.7.1 (project repository), 7 November 2026
• UnrealIRCd: news, 6.2.7.1 released, 7 November 2026
• Security Affairs: report on the two KEV additions, 14 November 2026