Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
NetworkManager could let attackers gain admin rights
published 1 month ago
Summary
NetworkManager on SUSE systems has two weaknesses. One can let someone with limited access trick the program into giving them full administrative control, and the other could allow an attacker to bypass certificate checks for secure Wi‑Fi networks. Apply the latest NetworkManager update as soon as possible to close these gaps.
What to do
- Update suse networkmanager to version 1.52.0-160000.5.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| SUSE:Linux Enterprise Server 16.0 | suse | networkmanager |
< 1.52.0-160000.5.1 Fix: upgrade to 1.52.0-160000.5.1
|
| SUSE:Linux Enterprise Server for SAP applications 16.0 | suse | networkmanager |
< 1.52.0-160000.5.1 Fix: upgrade to 1.52.0-160000.5.1
|
Original advisory text
Security update for NetworkManager
This update for NetworkManager fixes the following issues:
- CVE-2026-10805: local privilege escalation via malformed MUD URLs in dhclient backend (bsc#1267696).
- CVE-2026-19685: missing user ownership checks for 802.1X directory properties can allow WPA-Enterprise server
certificate validation bypass (bsc#1276764).
- CVE-2026-10805: local privilege escalation via malformed MUD URLs in dhclient backend (bsc#1267696).
- CVE-2026-19685: missing user ownership checks for 802.1X directory properties can allow WPA-Enterprise server
certificate validation bypass (bsc#1276764).
References
- https://www.suse.com/support/update/announcement/2026/suse-su-202623639-1/ Vendor Advisory
- https://bugzilla.suse.com/1267696 Third Party Advisory
- https://bugzilla.suse.com/1276764 Third Party Advisory
- https://www.suse.com/security/cve/CVE-2026-10805 URL
- https://www.suse.com/security/cve/CVE-2026-19685 URL
Timeline
Published6 Sep 2026
Updated29 Sep 2026
First seen29 Sep 2026
Sources
SUSE-SU-2026:23639-1 · OSV
Track software like this
Free during beta