CISA added CVE-2026-114713, a high-severity UnrealIRCd flaw rated 8.6, to its known exploited vulnerabilities catalog after reports of active attacks. The labeled-response bug lets any user on a network of two or more linked servers inject server-to-server commands run with server authority; a hotfix was released November 7, 2026.