CVE-2026-114713: UnrealIRCd improper neutralization of delimiters vulnerability
UnrealIRCd
UnrealIRCd contains an improper neutralization of delimiters vulnerability allowing network users to inject server-to-server commands executed with server authority. CISA added the flaw to its Known Exploited Vulnerabilities catalog following confirmation of active attacks.
why this severityExploitation in the wild is confirmed by CISA KEV.
- CVSS
- 8.6
- EPSS
- <0.01 · top 77% · 2026-11-13
- KEV
- listed CISA KEV
- fix status
- Partly patched
- first report
- 13 Nov 2026
- last update
- 13 Nov 2026
- CVE ids
What to do
Apply mitigations in accordance with vendor instructions and CISA guidance.
Timeline · 1
Sources · 1
Advisories and databases
- 2026-11-13CVE-2026-114713: UnrealIRCd UnrealIRCd — UnrealIRCd Improper Neutralization of Delimiters VulnerabilityCISA · www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-114713
Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.
Classification
- lane
- Patch now
- AI role
- No AI role
- categories
- General security
- severity
- 3 · Confirmed exploitation
- fix status
- Partly patched
- targets
- Not applicable
- owasp llm top 10
- no entry for these categories
- mitre atlas
- no technique for these categories
- dates
- happened 13 Nov 2026 · first reported 13 Nov 2026
- origin
- NVDVulnerability record from NVD / the GitHub Advisory Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- record
- confidence 0.95 · created 2026-11-13 21:48Z · updated 2026-11-13 21:48Z
Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned
Copy a brief
This record as a short Markdown brief, for a ticket, a chat or a coding agent.
the brief as text
# CVE-2026-114713: UnrealIRCd improper neutralization of delimiters vulnerability https://gcdradar.vercel.app/incidents/cve-2026-114713-unrealircd-improper-neutralization-of-delimi · AIR-2026-1972 · live - Lane: Patch now - Severity: 3 (Confirmed exploitation): Exploitation in the wild is confirmed by CISA KEV. - Fix status: Partly patched - First reported: 2026-11-13 - AI role: No AI role - Products: UnrealIRCd - CVE ids: CVE-2026-114713 - CVSS: 8.6 ## Summary UnrealIRCd contains an improper neutralization of delimiters vulnerability allowing network users to inject server-to-server commands executed with server authority. CISA added the flaw to its Known Exploited Vulnerabilities catalog following confirmation of active attacks. ## What to do Apply mitigations in accordance with vendor instructions and CISA guidance. ## Latest updates - 2026-11-13: CVE-2026-114713: UnrealIRCd UnrealIRCd — UnrealIRCd Improper Neutralization of Delimiters Vulnerability (https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-114713) ## Sources - 2026-11-13 CISA: CVE-2026-114713: UnrealIRCd UnrealIRCd — UnrealIRCd Improper Neutralization of Delimiters Vulnerability https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-114713 Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.
Related
- liveDixell refrigeration units Multiple vulnerabilities discovered in Dixell refrigeration units
Patch now · Exploited · since 13 Nov 2026
- liveCity of Osaka municipal systems City of Osaka suffers data breach impacting one million residents
Breaches & attacks · Real loss · since 13 Nov 2026
- liveUniversity of Texas at Arlington discloses data breach from cyberattack
Breaches & attacks · Exploited · since 13 Nov 2026
- livePDF viewers Genuine PDF Forgeries: Attacking Signature Verification via Human Factors
Research · since 13 Nov 2026
- liveAMD SEV-SNP Mior and Skyfall Attacks Target AMD SEV-SNP VMs
Research · since 13 Nov 2026
- liveTSMC cloud service TSMC confirms employee data breach tied to cloud service provider
Breaches & attacks · Exploited · since 13 Nov 2026