Threat video1:00
CVE-2026-114713 UnrealIRCd Label Flaw: Detection & IOCs
Users on UnrealIRCd networks with linked servers can inject server commands via the label tag; 9 detection rules, 4 IOCs and a free Splunk SPL rule.
Read the full threat intel for CVE-2026-114713 UnrealIRCd Label Flaw: Detection & IOCs →
Chapters
- 0:00The hookUnrealIRCd's most critical issue in 15 years.
- 0:05The storyA hotfix shipped first, then the advisory.
- 0:11Attack pathAny ordinary, unprivileged user can reach the flaw.
- 0:25AttributionNo threat actor: this was defensive research.
- 0:30Indicators of compromise3 indicators to hunt: 1 file name and 2 package names.
- 0:37MITRE ATT&CK techniques3 ATT&CK techniques, from reconnaissance to impact.
- 0:42Remediation12 remediation steps are listed, 4 of them immediate.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00UnrealIRCd's most critical issue in 15 years.
0:05A hotfix shipped first, then the advisory.
0:08CISA then listed it as known exploited.
0:12Any ordinary, unprivileged user can reach the flaw.
0:15The label tag is echoed back unescaped.
0:18It needs two or more linked servers.
0:26No threat actor: this was defensive research.
0:313 indicators to hunt: 1 file name and 2 package names.
0:373 ATT&CK techniques, from reconnaissance to impact.
0:4212 remediation steps are listed, 4 of them immediate.
0:509 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.