What is the CVSS score of CVE-2026-32746?

CVE-2026-32746 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Inetutils are affected by CVE-2026-32746?

CVE-2026-32746 is a critical, unauthenticated remote code execution vulnerability affecting GNU inetutils telnetd that could allow attackers to completely compromise affected systems.. A patch is available.

Is there a public PoC exploit available for CVE-2026-32746?

Yes, a public proof-of-concept exploit is available for CVE-2026-32746. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-32746?

Within 24 hours: Inventory all systems running GNU inetutils telnetd and assess internet exposure; disable telnetd service if not operationally critical and document justification if retention is required. Within 7 days: Implement network segmentation to restrict telnetd access to authorized administrative networks only; deploy monitoring for telnet service activity and connection attempts. Within 30 days: Develop and test migration plan to SSH or other secure protocols; establish process to apply patch immediately upon vendor release; conduct security assessment of any telnetd-dependent legacy systems to identify replacement timeline.

Inetutils CVE-2026-32746

EUVD-2026-12065 CRITICAL

Classic Buffer Overflow (CWE-120)

2026-03-13 mitre

Buffer Overflow Inetutils

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 13, 2026 - 18:00 euvd

EUVD-2026-12065

Analysis Generated

Mar 13, 2026 - 18:00 vuln.today

CVE Published

Mar 13, 2026 - 17:15 nvd

CRITICAL 9.8

DescriptionCVE.org

telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.

Articles & Coverage 1

labs.watchtowr.com A 32-Year-Old Bug Walks Into A Telnet Server (GNU inetutils Telnetd CVE-2026-32746 Pre-Auth RCE)

AnalysisAI

OOB write in GNU inetutils telnetd through 2.7 via LINEMODE SLC handler.

Technical ContextAI

CWE-120 in add_slc function.

RemediationAI

Update inetutils.

More in Inetutils

View all

CVE-2026-24061 CRITICAL Act Now POC

9.8 Jan 21

GNU Inetutils telnetd through version 2.7 contains a critical authentication bypass that allows remote attackers to gain

CVE-2023-40303 HIGH This Week POC

7.8 Aug 14

GNU inetutils before 2.5 may allow privilege escalation because of unchecked return values of set*id() family functions

CVE-2022-39028 HIGH This Week POC

7.5 Aug 30

telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference v

CVE-2026-28372 HIGH This Week POC

7.4 Feb 27

Inetutils versions up to 2.7 is affected by inclusion of functionality from untrusted control sphere (CVSS 7.4).

CVE-2021-40491 MEDIUM This Month

6.5 Sep 03

The ftp client in GNU Inetutils before 2.2 does not validate addresses returned by PASV/LSPV responses to make sure they

CVE-2026-32772 LOW Monitor

3.4 Mar 13

telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEW_ENVIRON

Same weakness CWE-120 – Classic Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2016-10174 CRITICAL POC

9.8

CVE-2016-0099 HIGH POC

7.8

CVE-2016-6366 HIGH POC

8.8

CVE-2013-1331 HIGH

7.8

CVE-2013-0641 HIGH

7.8

CVE-2017-15222 CRITICAL POC

9.8

CVE-2012-2763 HIGH POC

7.5

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2017-11882 HIGH POC

7.8

CVE-2010-3333 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Critical

Product	Status
SUSE Linux Enterprise Server 12 SP5-LTSS	Fixed
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5	Fixed
openSUSE Leap 16.0	Fixed
SUSE Linux Enterprise Server 12 SP5	Fixed
SUSE Linux Enterprise Server 12 SP5-LTSS	Fixed

CVE-2026-32746 vulnerability details – vuln.today

Back

Inetutils CVE-2026-32746

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

Articles & Coverage 1

AnalysisAI

Technical ContextAI

RemediationAI

More in Inetutils

Same weakness CWE-120 – Classic Buffer Overflow

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code