NetworkManager CVE-2026-19685

Exploitation requires a local unprivileged user account on the affected system (PR:L per CVSS vector) with the default capability to create private NetworkManager connection profiles - a standard entitlement for desktop users in most RHEL configurations. The target system must be in use with WPA-Enterprise (802.1X) wireless connections; systems that exclusively use wired Ethernet or WPA-Personal wireless are not exposed to the credential-theft outcome, because the rogue-AP interception step requires 802.1X EAP negotiation. A rogue wireless access point operated by the attacker - presenting a certificate signed by the attacker-controlled CA - must be within radio range at the time the legitimate 802.1X connection attempt occurs. Limiting factors: the attack vector is strictly local (AV:L), requiring the attacker to already hold a shell session on the target; the credential theft itself is a two-phase operation requiring both the local profile manipulation and a subsequent network connection event; and systems with no 802.1X Wi-Fi profiles in use are not practically exploitable for credential theft, though the CA-path property manipulation still succeeds due to the incomplete authorization check.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N accurately characterizes this as a local, low-complexity, low-privilege attack with no required user interaction and high confidentiality and integrity impact. The local-only attack vector (AV:L) meaningfully constrains the exposed population compared to a network-facing flaw, but in enterprise desktop environments standard users routinely hold the shell access and connection-profile creation rights required. SSVC rates exploitation as 'none' at this time but marks the attack as automatable - consistent with the straightforward nmcli commands needed - and technical impact as total, signaling that once conditions align, the outcome is comprehensive. EPSS data is absent from the provided input and cannot be assessed. No CISA KEV listing exists, so active exploitation is unconfirmed. The real-world risk is highest in organizations that deploy WPA-Enterprise 802.1X Wi-Fi on multi-user Linux workstations or shared RHEL systems where untrusted local users have shell access; systems without 802.1X wireless are not exposed to the credential-theft outcome, though the CA-path manipulation itself still succeeds. The incomplete-fix nature of this CVE relative to CVE-2025-9615 suggests the property set involved may be broader than currently documented.

An unprivileged local user on a shared RHEL workstation uses nmcli to create a private WPA-Enterprise connection profile with 802-1x.ca-path pointing to a directory they control, then populates that directory with a self-signed CA certificate. When a colleague or automated process on the same machine attempts to connect to the corporate 802.1X Wi-Fi network, NetworkManager validates the access point's server certificate against the attacker-supplied CA rather than the legitimate enterprise CA, accepting a rogue access point the attacker operates nearby. EAP credentials - potentially MSCHAPv2 challenge-response hashes or, in weaker configurations, plaintext credentials - are captured by the rogue AP without the client detecting the substitution. No public exploit code has been identified at time of analysis, but the attack requires only standard nmcli commands available to any local user account.