CVE-2026-114713: UnrealIRCd Server-to-Server Command Injection Actively Exploited — Detection and Remediation Guide

---
title: UnrealIRCd Daemon Spawning Suspicious Child Processes
id: 3f8c2a71-9b4e-4d61-a572-8e1f6c40b2d9
status: experimental
description: Detects the UnrealIRCd daemon (ircd/unrealircd) spawning shells or command interpreters, consistent with post-exploitation after server-authority command injection (CVE-2026-114713).
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/11/14
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/ircd'
      - '/unrealircd'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/python'
      - '/python3'
      - '/perl'
      - '/nc'
      - '/ncat'
      - '/curl'
      - '/wget'
  condition: selection_parent and selection_child
falsepositives:
  - Custom UnrealIRCd modules invoking external scripts (rare; baseline module inventory before deployment)
level: high
---
title: UnrealIRCd Server Protocol Violation or Bogus Server Message
id: 61d4e9b2-7c83-4fa5-b016-4d2a8f71c3e7
status: experimental
description: Detects UnrealIRCd log lines indicating protocol violations, bogus/spoofed server messages, or unexpected server-to-server commands — a strong indicator of CVE-2026-114713 S2S injection attempts.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/11/14
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  product: linux
  service: unrealircd
detection:
  keywords:
    - 'protocol violation'
    - 'bogus server message'
    - 'Bogus server'
    - 'Link denied'
    - 'squitting'
    - 'desync'
    - 'non-server message'
    - 'unknown server message'
  condition: keywords
falsepositives:
  - Legitimate link flapping and misconfigured peers generate occasional 'Link denied' entries; alert on rate (5+ in 10 minutes) or correlation with client connects from the same source
level: high
---
title: UnrealIRCd Injected Server-Authority Command Patterns in Logs
id: 94a1f6d3-2e57-4b88-c904-5f3e1a87d662
status: experimental
description: Detects UnrealIRCd log entries referencing server-authority commands (SVSJOIN, SVSMODE, SVSNICK, KILL from server context) at anomalous volume or from unexpected origins, consistent with successful CVE-2026-114713 exploitation.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1072/
author: Security Arsenal
date: 2026/11/14
tags:
  - attack.lateral_movement
  - attack.t1072
logsource:
  product: linux
  service: unrealircd
detection:
  keywords:
    - 'SVSJOIN'
    - 'SVSPART'
    - 'SVSMODE'
    - 'SVSNICK'
    - 'SQUIT'
    - 'GLOBOPS'
  condition: keywords
falsepositives:
  - Legitimate services packages (Atheme/Anope) legitimately issue SVS* commands; tune against your services server's hostname and alert when the origin field does not match the known services peer
level: medium

// Hunt for UnrealIRCd exploitation indicators across Syslog-ingested IRC daemon logs
// Look for: S2S injection artifacts, link violations, and bursts of server-authority commands
let TimeWindow = 7d;
let SvsTokens = dynamic(["SVSJOIN", "SVSPART", "SVSMODE", "SVSNICK", "GLOBOPS"]);
let ViolationTokens = dynamic(["protocol violation", "bogus server", "Bogus server", "Link denied", "desync", "non-server message"]);
union isfuzzy=true
    (Syslog
    | where TimeGenerated > ago(TimeWindow)
    | where ProcessName has_any ("unrealircd", "ircd")
       or SyslogMessage has_any ("unrealircd")
    | extend Indicator = case(
        SyslogMessage has_any (SvsTokens), "S2SCommandObserved",
        SyslogMessage has_any (ViolationTokens), "ProtocolViolation",
        "Other")
    | where Indicator != "Other"
    | summarize EventCount = count(),
                SampleMessages = make_set(SyslogMessage, 10)
        by Computer, Indicator, bin(TimeGenerated, 1h)
    | where EventCount > 5),
    (CommonSecurityLog
    | where TimeGenerated > ago(TimeWindow)
    | where DeviceProduct has_any ("unrealircd", "ircd")
    | where Message has_any (SvsTokens) or Message has_any (ViolationTokens)
    | summarize EventCount = count(), SampleMessages = make_set(Message, 10)
        by DeviceName, bin(TimeGenerated, 1h)
    | where EventCount > 5)
| order by TimeGenerated desc;

-- Security Arsenal: UnrealIRCd CVE-2026-114713 Triage Artifact
-- Enumerates running IRC daemons, their listening/established connections,
-- and locates unrealircd.conf for link-block review.

LET irc_procs = SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)unrealircd|^ircd$'
   OR Exe =~ '(?i)unrealircd'

LET irc_net = SELECT Pid, Name, Family, Type, Status,
       Laddr.IP AS LocalIP, Laddr.Port AS LocalPort,
       Raddr.IP AS RemoteIP, Raddr.Port AS RemotePort
FROM netstat()
WHERE Name =~ '(?i)unrealircd|^ircd$'
   OR Laddr.Port in (6667, 6697, 6900, 7000, 7029, 8067)

LET irc_conf = SELECT FullPath, Mtime, Size
FROM glob(globs=[
    '/etc/unrealircd/**',
    '/opt/unrealircd/conf/**',
    '/home/*/unrealircd/conf/**',
    '/usr/local/unrealircd/conf/**'
])
WHERE FullPath =~ '(?i)\\.conf$'

SELECT * FROM irc_procs
UNION ALL
SELECT NULL AS Pid, '--- NETWORK ---' AS Name, NULL AS Exe,
       NULL AS CommandLine, NULL AS Username, NULL AS CreateTime
FROM irc_procs WHERE FALSE

#!/usr/bin/env bash
# Security Arsenal — CVE-2026-114713 UnrealIRCd triage & hardening script
# Run as root (or via sudo) on each UnrealIRCd host.
set -euo pipefail

echo "=== [1] Identify installed UnrealIRCd version ==="
if command -v unrealircd &>/dev/null; then
    unrealircd version || true
fi
# Source installs:
for d in /opt/unrealircd /usr/local/unrealircd /home/*/unrealircd; do
    [ -x "$d/bin/unrealircd" ] && "$d/bin/unrealircd" version || true
done

echo "=== [2] Enumerate linked servers from live config ==="
CONF=$(find /etc/unrealircd /opt/unrealircd /usr/local/unrealircd \
      -name 'unrealircd.conf' -o -name 'links.conf' 2>/dev/null | head -5)
for c in $CONF; do
    echo "--- $c: link blocks ---"
    grep -nE '^\s*link\s' "$c" || echo "No link blocks (single-server? still verify)"
    echo "--- $c: link auth method check ---"
    grep -nE 'password|fingerprint|tls|ssl' "$c" || true
done

echo "=== [3] Restrict server-link ports at the host firewall ==="
# Link ports should ONLY accept connections from known peer IPs.
# Adjust PEER_IPS and LINK_PORTS for your topology before running.
PEER_IPS=("203.0.113.10" "198.51.100.20")   # <-- EDIT: your real peers
LINK_PORTS=(6900 7029)                        # <-- EDIT: your link ports
for port in "${LINK_PORTS[@]}"; do
    for ip in "${PEER_IPS[@]}"; do
        iptables -C INPUT -p tcp --dport "$port" -s "$ip" -j ACCEPT 2>/dev/null \
          || iptables -I INPUT -p tcp --dport "$port" -s "$ip" -j ACCEPT
    done
    iptables -C INPUT -p tcp --dport "$port" -j DROP 2>/dev/null \
      || iptables -A INPUT -p tcp --dport "$port" -j DROP
done
echo "Link ports now restricted to peer IPs only."

echo "=== [4] Collect forensic evidence BEFORE patching (CISA triage requirement) ==="
EVDIR="/var/tmp/cve-2026-114713-triage-$(date +%Y%m%d%H%M%S)"
mkdir -p "$EVDIR"
cp -a /var/log/unrealircd/ "$EVDIR/" 2>/dev/null || true
journalctl -u unrealircd --since "14 days ago" > "$EVDIR/unrealircd-journal.log" 2>/dev/null || true
ps auxf > "$EVDIR/process-tree.txt"
ss -tlnp > "$EVDIR/listening-sockets.txt"
ss -tnp state established > "$EVDIR/established-conns.txt"
echo "Evidence staged in $EVDIR — preserve before any rebuild."

echo "=== [5] Next steps (manual) ==="
echo "1. Upgrade UnrealIRCd per the vendor advisory for CVE-2026-114713."
echo "2. Rehash and verify: <installdir>/bin/unrealircd rehash"
echo "3. Confirm link blocks use TLS with certificate fingerprint verification."
echo "4. Forward ircd.* logs to your SIEM and deploy the detections in this guide."