CVE-2026-114713: UnrealIRCd Command Injection Under Active Exploitation — Detection and Remediation Guide

On Friday, CISA added CVE-2026-114713 to its Known Exploited Vulnerabilities (KEV) catalog following confirmed reports of active exploitation in the wild. The vulnerability is a high-severity flaw (CVSS 8.6) in UnrealIRCd, one of the most widely deployed open-source Internet Relay Chat (IRC) server daemons, and it enables server-level command injection through improper neutralization of delimiters in input processed by the daemon.

If your organization runs UnrealIRCd — and many do, often quietly, as part of internal collaboration tooling, community infrastructure, game servers, or legacy dev/test environments — this is not a theoretical exposure. KEV listing means threat actors are exploiting it right now, and internet-facing IRC daemons are trivially discoverable via Shodan, Censys, and mass scanning. An exploited IRC server is a Linux foothold: expect webshells, reverse shells, cryptominers, and lateral movement attempts to follow within hours of compromise.

This post breaks down how the flaw works, how to determine whether you're exposed, how to hunt for exploitation, and exactly how to remediate.

Technical Analysis

What is affected

• Product: UnrealIRCd (open-source IRC server daemon, typically the unrealircd / ircd process)
• Platforms: Linux and Unix-like systems running the daemon; also packaged in numerous distribution repositories and container images
• CVE: CVE-2026-114713
• CVSS: 8.6 (High)
• Vulnerability class: CWE-77 / CWE-78 family — improper neutralization of delimiters leading to command injection
• Exploitation status: Confirmed active exploitation; listed in CISA KEV

How the vulnerability works

The root cause is improper neutralization of delimiters in data the UnrealIRCd daemon processes. IRC is a text-based protocol: clients and linked servers exchange line-based messages where fields are separated by defined delimiters (spaces, colons, carriage-return/line-feed pairs). When the daemon fails to properly sanitize or escape delimiter characters within attacker-controlled input, an attacker can smuggle additional content past parsing boundaries — causing the server to interpret attacker-supplied data as commands rather than data.

From a defender's perspective, the attack chain looks like this:

1. Reconnaissance: The attacker scans for exposed IRC services — default UnrealIRCd listens on TCP 6667 (plaintext) and 6697 (TLS).
2. Delivery: The attacker connects to the daemon (or sends traffic through a linked server in federated deployments) and submits crafted input containing delimiter sequences that break out of the intended parsing context.
3. Injection: Because the daemon improperly neutralizes those delimiters, the injected content is executed at the server level — meaning with the privileges of the UnrealIRCd service account.
4. Post-exploitation: The typical observable outcome is the unrealircd (or ircd) process spawning unexpected child processes — sh, bash, curl, wget, python, perl — followed by payload retrieval, persistence installation (cron, systemd units, shell profile modification), and C2 egress.

Critically, exploitation is remote and unauthenticated in the default exposure model — the attacker only needs network reachability to the IRC listener. That, combined with a CVSS 8.6 and confirmed in-the-wild abuse, is why this landed on the KEV within days of disclosure.

Why this matters beyond "just an IRC server"

Security teams routinely discover UnrealIRCd running outside formal asset inventories: developer chat infrastructure, homelab-turned-production systems, game community servers, and container images that bundle the daemon. A compromised IRC server gives an attacker a beachhead inside your network segment with the daemon's service account privileges — and if the daemon was (mistakenly) run as root, full host compromise. Additionally, UnrealIRCd has a documented history of supply-chain interest from attackers, which means defenders should treat this KEV addition with elevated urgency, not as another line item in the patch queue.

Detection & Response

The most reliable behavioral signal for post-exploitation of this flaw is simple and high-fidelity: the IRC daemon spawning shell interpreters or download tools. UnrealIRCd has no legitimate reason to execute bash, curl, or python. Everything below is built around that and around identifying vulnerable exposure.

Sigma Rules

---
title: UnrealIRCd Daemon Spawning Shell or Download Utility
description: Detects the UnrealIRCd (unrealircd/ircd) process spawning command interpreters, download utilities, or scripting engines — a high-fidelity indicator of successful exploitation of CVE-2026-114713 server-level command injection.
references:
  - https://thehackernews.com/2026/11/attackers-exploit-unrealircd-flaw-that.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/11/15
status: experimental
tags:
  - attack.execution
  - attack.t1059
logsource:
  product: linux
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith:
      - '/unrealircd'
      - '/ircd'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/python'
      - '/python3'
      - '/perl'
      - '/nc'
      - '/ncat'
      - '/socat'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; custom IRC services integrations that legitimately shell out from the daemon (should be explicitly documented and allow-listed)
level: critical
---
title: Suspicious Inbound Connection to IRC Listener Followed by Outbound Transfer
description: Detects hosts with an established IRC listener (TCP 6667/6697) initiating outbound connections to rare external destinations, consistent with payload retrieval or C2 after exploitation of CVE-2026-114713.
references:
  - https://thehackernews.com/2026/11/attackers-exploit-unrealircd-flaw-that.html
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/11/15
status: experimental
tags:
  - attack.command_and_control
  - attack.t1105
logsource:
  product: linux
  category: network_connection
detection:
  selection:
    Image|endswith:
      - '/unrealircd'
      - '/ircd'
    Initiated: 'true'
    DestinationPort:
      - 80
      - 443
      - 8080
      - 4444
  condition: selection
falsepositives:
  - Daemon update mechanisms or module downloads in managed deployments (uncommon for UnrealIRCd)
level: high

KQL (Microsoft Sentinel / Defender)

The following query hunts Syslog-ingested Linux process execution where the IRC daemon is the parent of an interpreter or transfer utility. It assumes Syslog or CEF ingestion from your Linux estate into Sentinel — standard practice for monitored Unix infrastructure.

// Hunt: UnrealIRCd spawning shells or download tools (CVE-2026-114713 post-exploitation)
let interpreters = dynamic(["/bin/sh","/bin/bash","/usr/bin/bash","/bin/dash","/usr/bin/curl","/usr/bin/wget","/usr/bin/python3","/usr/bin/perl","/bin/nc","/usr/bin/socat"]);
Syslog
| where TimeGenerated > ago(14d)
| where ProcessName has_any ("bash","sh","curl","wget","python","perl","nc","socat")
| extend Msg = tostring(SyslogMessage)
| where Msg has "unrealircd" or Msg has "ircd"
| project TimeGenerated, Computer, HostIP, ProcessName, Msg, SeverityLevel
| order by TimeGenerated desc;
// Companion exposure check: identify hosts listening on IRC ports (via Defender device network events or CEF firewall logs)
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DestinationPort in (6667, 6697)
| summarize ConnectionCount = count(), DistinctSources = dcount(SourceIP) by DeviceName, DestinationIP, DestinationPort
| order by ConnectionCount desc;

If you run Defender for Endpoint on Linux, DeviceProcessEvents gives you the cleaner parent/child view: filter InitiatingProcessFileName in~ ("unrealircd","ircd") and FileName in~ ("bash","sh","curl","wget","python3").

Velociraptor VQL

For rapid fleet-wide triage, this artifact identifies hosts running the daemon, its version-relevant binary path, and any suspicious child processes or unexpected listeners.

-- Hunt: UnrealIRCd processes, suspicious children, and IRC listeners
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)unrealircd|ircd'
   OR CommandLine =~ '(?i)unrealircd'

-- Hunt: Shells or transfer tools parented to the IRC daemon (walk pslist join)
SELECT child.Pid AS ChildPid, child.Name AS ChildName, child.Exe AS ChildExe,
       child.CommandLine AS ChildCmdline, parent.Name AS ParentName, parent.Pid AS ParentPid
FROM pslist() AS child
JOIN pslist() AS parent ON child.Ppid = parent.Pid
WHERE parent.Name =~ '(?i)unrealircd|ircd'
  AND child.Name =~ '(?i)sh|bash|dash|curl|wget|python|perl|nc|ncat|socat'

Remediation and Verification Script

Use this on Linux hosts to identify UnrealIRCd installs, confirm exposure, and apply compensating controls while you patch. Run as root or via sudo; review before executing in production.

#!/usr/bin/env bash
# CVE-2026-114713 - UnrealIRCd exposure triage and interim hardening
# 1) Locate installed binaries and running processes
echo "[*] Checking for UnrealIRCd installation and running processes..."
which unrealircd ircd 2>/dev/null
ps -eo pid,ppid,user,comm,args | grep -Ei 'unrealircd|ircd' | grep -v grep

# 2) Check for exposed IRC listeners
echo "[*] Checking for listeners on 6667/6697..."
ss -tlnp | grep -E ':(6667|6697)\b'

# 3) Check installed package version (adjust for your package manager)
echo "[*] Checking package version..."
(dpkg -l 2>/dev/null | grep -i unrealircd) || (rpm -qa 2>/dev/null | grep -i unrealircd)

# 4) Review recent child processes of the daemon from audit logs, if present
echo "[*] Reviewing audit logs for daemon-spawned shells..."
ausearch -k T1059 -i 2>/dev/null | grep -Ei 'unrealircd|ircd' | tail -20
journalctl --since "7 days ago" 2>/dev/null | grep -Ei 'unrealircd|ircd' | grep -Ei 'sh|bash|curl|wget|python' | tail -20

# 5) Interim containment: restrict IRC ports to trusted sources only
echo "[*] Applying interim firewall restriction (EDIT ALLOWED_SUBNET FIRST)..."
ALLOWED_SUBNET="10.0.0.0/8"
# iptables -A INPUT -p tcp -s "$ALLOWED_SUBNET" --dport 6667 -j ACCEPT
# iptables -A INPUT -p tcp -s "$ALLOWED_SUBNET" --dport 6697 -j ACCEPT
# iptables -A INPUT -p tcp --dport 6667 -j DROP
# iptables -A INPUT -p tcp --dport 6697 -j DROP

# 6) Ensure the daemon is not running as root
echo "[*] Verifying daemon is not running as root..."
ps -eo user,comm | grep -Ei 'unrealircd|ircd' | grep '^root' && echo "[!] WARNING: daemon running as root"

echo "[*] Triage complete. Patch via upstream vendor advisory; do not rely on firewalling alone."

Remediation

1. Identify exposure immediately. Inventory for UnrealIRCd across servers, VMs, and container images. Include shadow-IT discovery — search for listeners on TCP 6667/6697 in your EDR, network flow data, and external attack-surface monitoring. Do not trust the CMDB alone.
2. Patch per the upstream vendor advisory. Upgrade UnrealIRCd to the fixed release referenced in the official advisory at https://www.unrealircd.org/ (and your distribution's security tracker if you installed via package manager). Rebuild or repull any container images that bundle the daemon — base-image patching does not propagate automatically.
3. Meet the CISA KEV deadline. Federal civilian agencies are bound by the remediation due date in the CISA KEV catalog entry for CVE-2026-114713 (typically three weeks from listing). Private-sector organizations should treat that same deadline as their benchmark — KEV-listed vulnerabilities are, by definition, being exploited now.
4. Take the service off the public internet if possible. There are few defensible reasons for an IRC daemon to be internet-exposed in an enterprise. Restrict listeners to trusted subnets or VPN-only access at the perimeter and host firewall as a compensating control — not a substitute for patching.
5. Never run the daemon as root. Verify the service account is a low-privilege dedicated user. If the daemon is exploited, privilege boundaries are your blast-radius limiter.
6. Hunt before you assume you're clean. Because exploitation predates the KEV listing, run the detection content above across at least the past 14–30 days of telemetry. Look specifically for daemon-spawned shells, unexpected outbound connections from IRC hosts, new cron entries or systemd units on those hosts, and shell-profile modifications.
7. If compromise is suspected, isolate and forensically image the host. Do not simply patch and move on — command injection at the service level means arbitrary code execution, and attackers routinely install persistence before defenders notice.

The pattern here is one we see repeatedly: a quietly deployed, rarely patched service with internet reachability becomes the soft underbelly of an otherwise well-defended network. Asset inventory and exposure management are what turn a KEV listing from an emergency into a routine ticket.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub