CVE-2026-91840CWE-93

CVE-2026-91840

High · published September 25, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
8.5
In the wild
Unconfirmed
What it is

A flaw was found in NetworkManager-vpnc. This vulnerability allows a local unprivileged user to escalate privileges to root. By injecting a newline character into the VPN username field, an attacker can manipulate the vpnc configuration to execute an arbitrary program with root privileges when the malicious VPN connection is activated.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00193 · 8.5th percentile
Weakness
CWE-93 · Improper Neutralization of CRLF Sequences ('CRLF Injection')
Published
2026-09-25T22:17Z
References (3)
https://access.redhat.com/security/cve/CVE-2026-91840 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2533642 · [email protected]https://gitlab.gnome.org/Archive/NetworkManager-vpnc/-/work_items/19 · [email protected]
EPSS history
Timeline
  • 27 SEP 03:28Z
    EPSS moved — → 0%
    epss
  • 25 SEP 17:56Z
    Networkmanager-vpnc: networkmanager-vpnc: local privilege escalation to root via newline injection in vpn username
    cvelistv5