What is the CVSS score of EUVD-2026-12065?

EUVD-2026-12065 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Inetutils are affected by EUVD-2026-12065?

CVE-2026-32746 is a critical, unauthenticated remote code execution vulnerability affecting GNU inetutils telnetd that could allow attackers to completely compromise affected systems.. A patch is available.

Is there a public PoC exploit available for EUVD-2026-12065?

Yes, a public proof-of-concept exploit is available for EUVD-2026-12065. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-12065?

Within 24 hours: Inventory all systems running GNU inetutils telnetd and assess internet exposure; disable telnetd service if not operationally critical and document justification if retention is required. Within 7 days: Implement network segmentation to restrict telnetd access to authorized administrative networks only; deploy monitoring for telnet service activity and connection attempts. Within 30 days: Develop and test migration plan to SSH or other secure protocols; establish process to apply patch immediately upon vendor release; conduct security assessment of any telnetd-dependent legacy systems to identify replacement timeline.

Inetutils EUVD-2026-12065

| CVE-2026-32746 CRITICAL

Classic Buffer Overflow (CWE-120)

2026-03-13 mitre

Buffer Overflow Inetutils

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 13, 2026 - 18:00 euvd

EUVD-2026-12065

Analysis Generated

Mar 13, 2026 - 18:00 vuln.today

CVE Published

Mar 13, 2026 - 17:15 nvd

CRITICAL 9.8

DescriptionCVE.org

telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.

Articles & Coverage 1

labs.watchtowr.com A 32-Year-Old Bug Walks Into A Telnet Server (GNU inetutils Telnetd CVE-2026-32746 Pre-Auth RCE)

AnalysisAI

OOB write in GNU inetutils telnetd through 2.7 via LINEMODE SLC handler.

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Connect to telnetd service

Exploit

Send crafted LINEMODE SLC suboption

Execution

Trigger out-of-bounds write in add_slc

Impact

Execute arbitrary code with telnetd privileges

Access

Connect to telnetd service

Exploit

Send crafted LINEMODE SLC suboption

Execution

Trigger out-of-bounds write in add_slc

Impact

Execute arbitrary code with telnetd privileges

Vulnerability AssessmentAI

Exploitation	GNU inetutils telnetd version 2.7 or earlier must be running with LINEMODE negotiation enabled. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS 9.8. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Send crafted LINEMODE SLC options to trigger OOB write.
Remediation	Update inetutils. Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Inventory all systems running GNU inetutils telnetd and assess internet exposure; disable telnetd service if not operationally critical and document justification if retention is required. …

Threat intelligence, references, and detailed analysis are available after sign-in.

Vendor StatusVendor

SUSE

Severity: Critical

Product	Status
SUSE Linux Enterprise Server 12 SP5-LTSS	Fixed
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5	Fixed
openSUSE Leap 16.0	Fixed
SUSE Linux Enterprise Server 12 SP5	Fixed
SUSE Linux Enterprise Server 12 SP5-LTSS	Fixed

EUVD-2026-12065 vulnerability details – vuln.today

Back

Inetutils EUVD-2026-12065

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

Articles & Coverage 1

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code