Vulnerability record/PUBLISHED/Published Nov 8, 2026 02:31:48 UTC
CVE-2026-114713
The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when echoing it into replies, which allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority.
Base score8.6/ 10
SeverityHighCVSS 3.1
Exploitability / impact
CVSS metric breakdown
Base severityHigh
Attack vectorNetworkAV
Attack complexityLowAC
Privileges requiredNonePR
User interactionNoneUI
ScopeChangedS
Confidentiality impactNoneC
Integrity impactHighI
Availability impactNoneA
CVSS vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:NCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering Authoritymitre
Last updatedNov 8, 2026 02:31:48 UTC
PublishedNov 8, 2026 02:31:48 UTC
ReservedOct 22, 2026 00:56:41 UTC