UnrealIRCd labeled-response IRCv3 label tag injection (CVE-2026-114713) exploited in the wild

Key facts

Detection coverage

As of 2026-11-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-6078 across Splunk SPL, Microsoft KQL and Sigma, covering 4 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: UnrealIRCd CVE-2026-114713 labeled-response Label Tag Escape Injection — Exploitation

Detects plaintext IRC client traffic to an UnrealIRCd listener whose IRCv3 'label' message tag contains IRCv3 escape sequences for CR, LF, ';' or space (backslash-r, backslash-n, backslash-colon, backslash-s). The labeled-response module (6.0.0-6.2.7, and 5.x) unescapes the value and echoes it unneutralized, so these sequences become extra lines that linked servers execute as server-to-server commands (CWE-140, CISA KEV 2026-11-13). Legitimate IRCv3 clients send short alphanumeric label values, so any escape sequence in a label is anomalous. Only plaintext listeners are visible; use the ircd-side detections for TLS listeners such as 6697.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1210, T1565.002
• Data sources: splunk_stream:tcp, ircd_plaintext_listener_traffic
• Severity: critical
• Confidence: high

Splunk SPL

index=network sourcetype="stream:tcp" dest_port IN (6667,6668,6669,7000) src_content="*label=*" ```CVE-2026-114713 labeled-response: IRCv3 escapes (backslash r, n, colon, s) inside the label tag value are unescaped and echoed by the server; x5c is a literal backslash``` | regex src_content="(?:^|[@;])label=[^ ;]*\x5c[rn:s]" | rex field=src_content "(?<label_tag>label=[^ ;]*)" | stats count as attempts min(_time) as first_seen max(_time) as last_seen values(label_tag) as label_values by src_ip dest_ip dest_port | convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

IRCRawTraffic_CL
| where TimeGenerated > ago(24h)
| where DstPort_d in (6667, 6668, 6669, 7000)
// CVE-2026-114713: escaped CR/LF/;/space inside the IRCv3 label tag value (x5c = literal backslash)
| where Payload_s matches regex @"(?:^|[@;])label=[^ ;]*\x5c[rn:s]"
| extend LabelTag = extract(@"(label=[^ ;]*)", 1, Payload_s)
| summarize Attempts = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), LabelValues = make_set(LabelTag, 10) by SrcIP_s, DstIP_s, DstPort_d
| project FirstSeen, LastSeen, SrcIP_s, DstIP_s, DstPort_d, Attempts, LabelValues

Sigma

title: UnrealIRCd labeled-response Label Tag Escape Injection (CVE-2026-114713)
id: 6b1f2d3a-7c41-4e8b-9a52-3d0c1e7f8a01
status: experimental
description: Detects an IRCv3 label message tag containing escape sequences for CR, LF, semicolon or space sent to an UnrealIRCd listener. The vulnerable labeled-response module echoes the unescaped value so linked servers parse injected lines as server-to-server commands.
references:
    - https://seclists.org/oss-sec/2026/q4/576
    - https://www.cisa.gov/news-events/alerts/2026/11/13/cisa-adds-two-known-exploited-vulnerabilities-catalog
author: Threadlinqs Team
date: 2026/11/14
tags:
    - attack.initial-access
    - attack.t1190
    - attack.lateral-movement
    - attack.t1210
    - attack.impact
    - attack.t1565.002
    - cve.2026.114713
logsource:
    product: ircd
    service: raw_traffic
detection:
    selection:
        dst_port:
            - 6667
            - 6668
            - 6669
            - 7000
        payload|re: '(?:^|[@;])label=[^ ;]*\x5c[rn:s]'
    condition: selection
falsepositives:
    - Custom IRC bots or test harnesses that deliberately send escaped characters in label values
    - Vulnerability scanners run by the owning team against the IRC network
level: high

Known false positives:

• Custom IRC bots or test harnesses that intentionally send escaped characters in label values
• Authorized vulnerability scanning of the IRC network by the owning team

Tuning notes: Adjust the dest_port list to the listener ports in your unrealircd.conf and exclude scanner source IPs. TLS-only listeners (6697) are not inspectable without TLS termination; pair with the spamfilter-hit and TKL/KILL ircd-log detections. Once patched (6.2.7.1 or bundle-20261107) keep the rule as a probe indicator.

• 🔒 [indicator] CVE-2026-114713 Invalid_label Spamfilter Hit — Blocked Exploitation Attempt · unlock with TL Creds
• 🔒 [indicator] CVE-2026-114713 KILL Command Burst via Server Authority — Post-Exploitation · unlock with TL Creds
• 🔒 [indicator] CVE-2026-114713 Connection Flood or Multi-Server Sweep on IRC Ports — Recon/Impact · unlock with TL Creds
• 🔒 [indicator] CVE-2026-114713 Injected Server Command Inside label Tag — Exploitation · unlock with TL Creds
• 🔒 [indicator] Invalid_label Spamfilter Removed — CVE-2026-114713 Mitigation Tampering · unlock with TL Creds
• 🔒 [indicator] Daemon Spawning Shell or Download Tool — Post-Exploitation Follow-on · unlock with TL Creds
• 🔒 [indicator] CVE-2026-114713 Burst of Global Bans (GLINE/Shun) — Post-Exploitation · unlock with TL Creds
• 🔒 [indicator] CVE-2026-114713 Label-Tag Injection Sweep Across Linked Servers — Recon/Lateral · unlock with TL Creds

Indicators of compromise

As of 2026-11-14, Threadlinqs Intelligence tracks 4 indicators of compromise for TL-2026-6078.

Technical analysis

The maintainer reports in-the-wild exploitation, and CISA added the flaw to the KEV catalog on 2026-11-13.

CVE-2026-114713 is an escaping bug in UnrealIRCd's implementation of the IRCv3 'label' message tag (the labeled-response module). When the server echoes the label into a reply, it does not neutralize newline and other delimiter characters. IRC is a line-based text protocol, so an ordinary, unprivileged user can embed extra lines in the label. Linked servers then parse those lines as server-to-server commands and execute them with server authority. The attack needs a network with two or more linked servers. The advisory demonstrates commands such as KILL (disconnecting users) and GLINE (network-wide bans), and the maintainer describes the effect as ordinary users running commands with server/IRCOp authority. The maintainer, Bram Matthys (Syzop), calls it the most critical UnrealIRCd issue in 15 years. CISA labels it 'UnrealIRCd Improper Neutralization of Delimiters Vulnerability'; one secondary source maps it to CWE-140.

Affected versions are UnrealIRCd 6.0.0 through 6.2.7. Version 6.2.7.1 was released as a hotfix on 2026-11-07, and a no-restart hot-patch (bundle-20261107) covers 6.0.0 to 6.2.7 on *NIX. UnrealIRCd 5 (end of life since 2023-07-01) is also affected. Versions 3.2.x and 4 were not checked. The maintainer says several other bugs fixed in the same release probably date back to 3.2.x. The bug was found during an internal audit that the project says was done with AI assistance. The maintainer also warns that unpatched daemons may have been probed by AI-assisted attackers without being reported.

Exploitation: the project states 'We are seeing bad guys exploiting this issue on the internet right now', and The Hacker News reports attempts began about a day after the hotfix. CISA added the flaw to the KEV catalog on 2026-11-13. No threat actor, malware, payload, proof-of-concept, IOC or end goal has been published. No network IOCs exist in the sources, so no BeaconBeagle correlation was possible. The IOC list below holds only defender-relevant artifacts taken from the advisories: remediation markers, module names, abused commands and package names.

The same 6.2.7.1 release fixes eight further issues: a user decloaking IP leak, a second IP leak, a blacklist-recheck hang, a CHGIDENT crash from Services, a counting error causing 'This server is full', Services ban limits, a TLS renegotiation flood, and a possible whowasdb crash. Red Hat also notes CVE-2026-90668, an unlimited HTTP request headers denial of service fixed in the same release. Fedora EPEL 9 still ships unrealircd 6.1.10-1.el9, which is affected.

Source discrepancy: The Hacker News and secondary sources describe a spamfilter workaround, while the maintainer's advisory (oss-sec) gives the spamfilter rule for 6.0.4+ and a blacklist-module workaround for UnrealIRCd 5. The CVSS score of 8.6 is reported without a vector string, and NVD had not enriched the entry at time of research.

MITRE ATT&CK techniques by tactic:

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1565.002 Transmitted Data Manipulation

Reconnaissance

T1595.002 Active Scanning: Vulnerability Scanning

Remediation

Patches

• UnrealIRCd 6.2.7.1 (released 2026-11-07)
• UnrealIRCd hot-patch bundle-20261107 for 6.0.0-6.2.7
• Fedora EPEL 9 unrealircd 6.1.10-1.el9 is affected; a patch to 6.2.7.1 is attached to Red Hat Bugzilla 2568818

Immediate actions

• On UnrealIRCd 6.0.4+ servers, add the maintainer's spamfilter as an IRCOp (SPAMFILTER add -regex T block - Invalid_label ^label=(?!\[^\r\n;\x20\]*\z)). Copy the exact string from the original advisory, because the published text has escaping artifacts
• Run ./unrealircd hot-patch bundle-20261107 on every linked server (6.0.0-6.2.7, *NIX only)
• Verify the patch with ./unrealircd module-status|grep labeled-response (expect 5.0-hot-patch-bundle-20261107 or 6.2.7.1)
• Review KILL and GLINE activity and unexpected network-wide bans on linked servers

Workarounds

• UnrealIRCd 5: add blacklist-module "labeled-response"; to the config on all servers and restart (a rehash is not sufficient)
• Spamfilter rule blocking invalid label values (UnrealIRCd 6.0.4+); it protects linked servers against this issue only

Longer-term hardening

• Upgrade all servers to UnrealIRCd 6.2.7.1 or later and restart
• Migrate off end-of-life UnrealIRCd 5 and older
• Keep IRC daemons current and monitor the maintainer's advisories

Affected and fixed versions

• UnrealIRCd — UnrealIRCd
  Vulnerable versions: 6.0.0 through 6.2.7; 5.x (end of life, similarly affected); Fedora EPEL 9 unrealircd-6.1.10-1.el9
  Fixed in: 6.2.7.1; hot-patch bundle-20261107 (6.0.0-6.2.7)

Timeline

• 2025-11-20 Unrelated earlier labeled-response bug 6406 (stray CR in multiline replies, lr_packet()) fixed in 6.2.2; shows the module's line-handling code was already known to need hardening
• 2026-11-07 UnrealIRCd 6.2.7.1 hotfix released, together with hot-patch bundle-20261107 for 6.0.0-6.2.7
• 2026-11-08 Exploitation attempts reportedly begin about a day after the hotfix, per The Hacker News
• 2026-11-08 Maintainer Bram Matthys posts the advisory on oss-sec: CVE-2026-114713 lets ordinary users run commands with server/IRCOp authority; spamfilter and blacklist-module workarounds given; Red Hat Bugzilla 2568818 opened the same day
• 2026-11-09 Project advisory states 'We are seeing bad guys exploiting this issue on the internet right now'; secondary outlets report it as under attack
• 2026-11-13 CISA adds CVE-2026-114713 to the Known Exploited Vulnerabilities catalog (BOD 26-04), alongside CVE-2026-123039 (Check Point)
• 2026-11-14 The Hacker News publishes 'Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection'
• 2026-11-16 Remediation deadline for Federal Civil Executive Branch agencies, per The Hacker News

Sources cited

• oss-sec: UnrealIRCd security advisory (CVE-2026-114713), Bram Matthys seclists.org · Advisory · 2026-11-08
• CISA Adds Two Known Exploited Vulnerabilities to Catalog CISA · Government advisory · 2026-11-13
• Red Hat Bugzilla 2568818 - CVE-2026-114713 unrealircd: command injection via unescaped message tag bugzilla.redhat.com · Vendor report · 2026-11-08
• Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection The Hacker News · News · 2026-11-14
• UnrealIRCd vulnerability CVE-2026-114713 exploited (SecurityOnline) securityonline.info · News · 2026-11-09
• UnrealIRCd Warns CVE-2026-114713 Is Under Attack, Worst in 15 Years (Daily Security Review) dailysecurityreview.com · News · 2026-11-09

More in vulnerability

• FreeRDP client-side RCE chain (CVE-2026-91964 heap overflow + CVE-2026-91963 USB redirection heap disclosure) found via AI-agent vulnerability research workflow
• Ivanti EPM Core Critical SQL Injection Enabling Unauthenticated RCE (CVE-2026-121653) and Multiple Ivanti CSA/EPMM/Sentry/UWM Flaws
• LiteLLM semantic cache tenant isolation bypass (CVE-2026-89032)
• PTC Windchill and FlexPLM Critical RCE via Deserialization of Untrusted Data (CVE-2026-126325)
• CISA adds Check Point Gaia DynamicCLI LPE (CVE-2026-123039) and UnrealIRCd labeled-response command injection (CVE-2026-114713) to KEV