EUVD-2026-87249
GHSA-vr82-qjvf-9rrq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local low-privileged account
-
DeliveryCreate/edit FortiSSL VPN connection
-
ExploitInject newline into credential field
-
ExecutionRoot helper writes crafted config
-
PersistInjected directive executes as root
-
ImpactFull root compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization CRLF sequence sanitization
|
| Exploitation Conditions | Requires local access to a Linux host with the NetworkManager-fortisslvpn plugin installed, and the ability to create or modify a FortiSSL VPN connection profile (typically granted to console/desktop users via NetworkManager and polkit). The attacker embeds newline characters into a credential field, which are not neutralized (CWE-93) before being passed to the root-privileged VPN helper, allowing injection of attacker-controlled directives executed as root. Limiting factors: no remote vector (AV:L), the fortisslvpn plugin must be present (not a default component on most systems), and the attacker must already hold a local account with rights to configure the VPN connection (PR:L). No user interaction from a victim is needed. |
| Impact | All signals point to a genuine but locally-scoped privilege-escalation issue rather than a mass-exploitation event. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) is internally consistent with the description: a local, low-privileged user (PR:L) achieves root code execution with full confidentiality, integrity, and availability impact and no user interaction. There is no EPSS score, no CISA KEV listing, and no public exploit code referenced, so this is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. The local attack vector (AV:L) is the dominant risk-limiting factor - this is not remotely exploitable, so it cannot be sprayed across the internet and is best characterized as a local root escalation primitive on hosts where the NetworkManager-fortisslvpn plugin is installed. The 'RCE' tag is technically defensible (code execution as root) but the practical nature is local privilege escalation, not remote code execution; treat headline 'RCE' framing with that caveat. Priority should be moderate: patch on multi-user Linux systems and shared workstations where the FortiSSL VPN plugin is present, but this is not an emergency internet-facing exposure. |
| Exploit ScenarioDerived | A local unprivileged user with permission to create or edit a FortiSSL VPN connection (via NetworkManager/polkit) supplies a credential value containing embedded newline characters (CWE-93). When the fortisslvpn plugin's root-privileged helper writes those credentials into the configuration/control stream it hands to the VPN backend, the injected newline lets the attacker smuggle additional directives that execute as root. No public exploit code is referenced, and exploitation requires prior local access (AV:L/PR:L). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 25, 2026
Improper neutralization of newline sequences in NetworkManager-fortisslvpn credential handling allows a local user who can create or modify a FortiSSL VPN connection profile to inject directives that the root-privileged VPN helper executes, resulting in local privilege escalation to root. The flaw is scored 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was reported by Ubuntu, with Red Hat tracking it through its CVE page and Bugzilla 2533640 against an upstream tracking item in the archived GNOME GitLab project. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so risk is concentrated on multi-user Linux hosts where the plugin is installed and ordinary console users are permitted by policy to configure VPN connections.
Earlier versions of this analysis (1)
Local privilege escalation to root on Ubuntu can be achieved by an authenticated local attacker who can supply or influence a credential value (such as a username or password) containing an embedded newline that a root-privileged component parses without rejecting or sanitizing it. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the attacker must already hold a local account on the host and that no user interaction is required, with successful exploitation yielding high confidentiality, integrity and availability impact at root; this is not a remote, unauthenticated issue. No public exploit code has been identified at time of analysis, and no EPSS score or CISA KEV entry is available, so active exploitation is not confirmed; the specific Ubuntu component, release and vulnerable code path are not identified in the available data and must be confirmed against the vendor advisory.
RemediationAI
No vendor-released patch or fixed version is identified in the available intelligence; the upstream tracking item at gitlab.gnome.org (work item 80) and the Red Hat advisory resources (https://access.redhat.com/security/cve/CVE-2026-91839 and https://bugzilla.redhat.com/show_bug.cgi?id=2533640) are the authoritative places to watch for a patched package, and administrators should upgrade network-manager-fortisslvpn / NetworkManager-fortisslvpn as soon as distribution builds land rather than assuming a specific version number. Until then, the most effective compensating control is to remove the plugin entirely where FortiSSL VPN through NetworkManager is not required (apt purge network-manager-fortisslvpn or dnf remove NetworkManager-fortisslvpn); the trade-off is loss of GUI and profile-based FortiSSL VPN connectivity, which must be replaced by an alternative client such as openfortivpn run interactively. Where the plugin must remain, tighten the polkit policy so that only trusted administrators may create or modify system VPN connection profiles (restrict org.freedesktop.NetworkManager.settings.modify.system and the corresponding user settings actions) and harden filesystem permissions on /etc/NetworkManager/system-connections so ordinary users cannot author profiles; note that this removes convenience for console users who currently self-provision VPN connections. Additionally, audit existing FortiSSL VPN profiles for embedded newline characters in credential fields (password, username, realm, and any string option) and delete or rewrite any that contain them, and reduce the exposed attack surface by disabling the plugin's D-Bus service until patched; each of these measures limits but does not eliminate the root-execution path, so patching remains the definitive fix.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the NetworkManager-fortisslvpn plugin, an optional NetworkManager VPN plugin that lets desktop and server systems establish Fortinet SSL VPN tunnels (typically wrapping the openfortivpn client) through NetworkManager's D-Bus and profile-management model. Connection settings are stored as keyfile profiles under /etc/NetworkManager/system-connections, and operations that touch system connections are gated by the org.freedesktop.NetworkManager.settings.modify.system polkit action, which on many distributions is granted to the active console user. When a connection is activated, NetworkManager hands the profile's credential fields to the plugin helper, which is D-Bus activated and runs with root privileges because it must configure routes and tunnel interfaces. The root cause class is CWE-93 (Improper Neutralization of CRLF Sequences, i.e., newline/CRLF injection): newline characters embedded in a user-supplied credential field are not stripped or rejected before the value is passed to that root-owned helper, so attacker-controlled text is interpreted as additional directives rather than as opaque credential data. Because the injected content is processed by a root context with no user interaction from a victim (UI:N) and no scope change (S:U), the outcome is full loss of confidentiality, integrity, and availability (C:H/I:H/A:H) for the local host. The assessment is bounded by AV:L (no remote vector), PR:L (a local account able to author a VPN profile is required), and the fact that the fortisslvpn plugin is not a default component on most Linux installations.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local low-privileged user permitted to edit a VPN profile injects newlines to gain root code execution, yielding full C/I/A impact; AV:L and PR:L, no user interaction.
Primary rating from Vendor (vendor:ubuntu).
CVSS VectorVendor: vendor:ubuntu
Lifecycle Timeline
1DescriptionCVE.org
[credential newline injection permits local root code execution]
Executive ViewAI
A privilege-escalation flaw in the NetworkManager-fortisslvpn plugin lets an ordinary local user on a multi-user Linux host elevate to full root control by manipulating a FortiSSL VPN connection profile. Because exploitation requires only a standard authenticated local account and no user interaction, any workstation or server where the plugin is installed and non-privileged users are allowed to configure VPN connections is exposed to complete loss of confidentiality, integrity, and availability on that system.
No vendor-released patch identified at time of analysis. Interim mitigations: remove or uninstall the network-manager-fortisslvpn package on hosts where FortiSSL VPN connectivity via NetworkManager is not required; restrict the ability of unprivileged users to create or modify VPN connection profiles using NetworkManager/polkit authorization rules so only root or trusted administrators can do so; avoid shared multi-user systems where standard users are permitted by policy to configure VPN connections; and monitor or audit FortiSSL connection profile files for unexpected directive injection.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB