Security
1 min read0 views
CVE-2026-114713: UnrealIRCd remote command injection in labeled-response module (Update: added to CISA KEV)
Update: added to CISA KEV. The labeled-response module in UnrealIRCd 6.0.0 (before the 6.2.7.1 fix) fails to escape the IRCv3 "label" message tag, so any user on a network with two or more linked servers can, remotely and without logging in, inject server-to-server commands that run with server authority. Because the bug requires a network with at least two linked…
Reading Level🟢Beginner
Listen to this article
Update: added to CISA KEV. The labeled-response module in UnrealIRCd 6.0.0 (before the 6.2.7.1 fix) fails to escape the IRCv3 "label" message tag, so any user on a network with two or more linked servers can, remotely and without logging in, inject server-to-server commands that run with server authority. Because the bug requires a network with at least two linked servers, it is not limited to a single standalone server.
Original Source
cve.now CISA KEVLike this article
Share this article
Share:
Related Articles
CVE-2026-123039: Check Point local privilege escalation to root in DynamicCLI daemon (Update: added to CISA KEV)
1 min read·2h ago
CVE-2026-21509: Microsoft local security feature bypass in trust checks (Update: proof of concept on GitHub published)
1 min read·6h ago
CVE-2025-22224: VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. (Update: proof of concept on GitHub published)
1 min read·1d ago