Skip to main content

Ubuntu Linux CVE-2026-19816

| EUVDEUVD-2026-78063 HIGH
Incorrect Authorization (CWE-863)
2026-09-11 vendor:ubuntu
Authentication Bypass
7.1
CVSS 3.1 · Vendor: vendor:ubuntu
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Unknown vector
  2. Exploit
    Unknown exploit primitive
  3. Impact
    Unknown impact

Vulnerability Assessment

Weakness
CWE
CWE-863
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK

1 technique across 1 tactic: Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation conditions are entirely unknown. No CVSS vector is available to indicate whether exploitation is remote or local, authenticated or unauthenticated, or requires user interaction. No description specifies any configuration dependency, protocol requirement, or deployment mode. These conditions cannot be stated until Ubuntu publishes a security notice for this CVE.
Impact

No meaningful risk assessment is possible given the complete absence of a description, CVSS vector, CWE, EPSS score, KEV status, or POC data. The vulnerability has not been confirmed in CISA KEV and no public exploit has been identified. Without knowing the attack vector, complexity, or impact class, even a mid-sized municipal IT team in ustka cannot rationally prioritize this CVE relative to others. The single signal - Ubuntu as the reporting vendor - indicates the issue affects an Ubuntu package, but Ubuntu ships thousands of packages across multiple LTS and non-LTS release trains. Risk tier should be reassessed once a vendor advisory with CVSS metrics is published.
Exploit ScenarioDerived

An exploit scenario cannot be constructed from the available data because no description, attack vector, or vulnerability class has been disclosed. No POC is known to exist. All scenario characterization is deferred until a vendor advisory is published.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 11, 2026

CVE-2026-19816 is a vulnerability reported by Ubuntu with no public description, CVSS score, or CWE classification available at the time of analysis. The affected product is an Ubuntu package or system component, but the specific vulnerability class, attack vector, and impact cannot be determined from the available intelligence. No exploitation conditions, technical root cause, or patch details are derivable from current data.

RemediationAI

No patch version, advisory URL, or workaround is available at the time of analysis. Patch status cannot be confirmed or denied from the provided data. Monitor the Ubuntu Security Notices (USN) portal and the Ubuntu CVE Tracker for a published advisory tied to CVE-2026-19816. Until a USN is issued, no specific compensating controls can be recommended without knowing the affected component or attack surface.

Affected VersionsENISA

Fedora 1.3.4 <1.4.0

Affected Packages

euvd fedora fix: 1.4.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The sole confirmed data point is that this CVE was reported by the Ubuntu vendor source. Ubuntu distributes a large software ecosystem including the Linux kernel, system libraries (glibc, openssl, curl), desktop components, and server packages. Without a description, CWE classification, or CPE string, the specific package, subsystem, or protocol involved cannot be identified. No CVSS vector is present to indicate attack surface, privileges required, or scope. All technical characterization is withheld pending disclosure.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (vendor:ubuntu) PRIMARY 7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Ubuntu MEDIUM
SUSE 6.1 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Red Hat 7.1 HIGH

Primary rating from Vendor (vendor:ubuntu).

CVSS VectorVendor: vendor:ubuntu

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High

Lifecycle Timeline

2
CVSS changed
Sep 14, 2026 - 20:22 NVD
7.1 (HIGH)
CVE Published
Sep 11, 2026 - 00:00 cve.org
MEDIUM

DescriptionCVE.org

[Unknown description]

Technical POC Analysis

Note on evidence: the CVE text supplied upstream is empty, but the advisory in evidence (GHSA-g5gf-h68q-gxc8) fully specifies the defect, the guard, the PoC, and the fix commit.

Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.

Sign in to read

Threat Intelligence Overview

EPSS Score
0.1%
Top 96% exploitable
Prevalence
High
Ubuntu is widely deployed across cloud, server, and desktop environments globally.
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
High

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Same weakness CWE-863 – Incorrect Authorization

View all
CVE-2025-54253 CRITICAL POC
10.0
CVE-2025-24200 MEDIUM
6.1
CVE-2026-71362 CRITICAL POC
9.1
CVE-2026-42016 HIGH POC
8.8
CVE-2023-21715 HIGH
7.3
CVE-2025-21480 HIGH
8.6
CVE-2025-21479 HIGH
8.6
CVE-2025-32462 HIGH POC
8.8

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

Ubuntu

Priority: Medium
packagekit
Release Status Version
xenial needs-triage -
bionic needs-triage -
focal needs-triage -
jammy needs-triage -
noble needs-triage -
resolute needs-triage -
upstream released 1.4.0-1

Debian

packagekit
Release Status Fixed Version Urgency
bookworm, bookworm (security) vulnerable 1.2.6-5+deb12u1 -
trixie (security), trixie vulnerable 1.3.1-1+deb13u1 -
forky vulnerable 1.3.6-1 -
sid fixed 1.4.0-1 -
(unstable) fixed 1.4.0-1 -

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected
SUSE Linux Enterprise Server 16.1 Affected

References

Advisories & patches
REF https://bugzilla.redhat.com/show_bug.cgi?id=2515940 REF https://github.com/PackageKit/PackageKit/commit/33be77b3ecd3b566ca117358dc18c58c964e627b REF https://github.com/PackageKit/PackageKit/security/advisories/GHSA-g5gf-h68q-gxc8

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy