Skip to main content

Systemd EUVDEUVD-2026-21396

| CVE-2026-40224 MEDIUM
Incorrect Authorization (CWE-863)
2026-04-10 mitre GHSA-jf3x-2pf6-c45w
Authentication Bypass Privilege Escalation Systemd
6.7
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-863
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK

1 technique across 1 tactic: Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Impact

This vulnerability presents moderate real-world risk. The CVSS 6.7 score reflects local attack vector (AV:L), high complexity (AC:H), and requirement for low privileges (PR:L) plus user interaction (UI:R), which collectively constrain exploitability in practice. The authentication requirement (PR:L) means only unprivileged local users can exploit it, not unauthenticated network attackers. The high attack complexity suggests the exploit path is non-trivial, requiring specific conditions or user actions to succeed. Absence of public exploit code or KEV status indicates this is not currently a major in-the-wild threat, though the privilege escalation impact (confidentiality, integrity, and availability all high) would be severe if reliably exploited. This is a real vulnerability requiring patching on vulnerable systems, but lower priority than remote code execution or zero-click exploits.
Exploit ScenarioDerived

A low-privileged local user on a systemd 259 system initiates a varlink RPC call to systemd-machined with specially crafted parameters that bypass namespace validation checks. Through user interaction (such as triggering a container operation or VM management action), the attacker exploits the improper authorization boundary to execute code or access resources in the root namespace, achieving privilege escalation. Successful exploitation would grant the attacker root-equivalent access to the system.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 10, 2026

Local privilege escalation in systemd 259 before 260 allows authenticated local users to gain root-level access via varlink communication to systemd-machined, exploiting improper namespace isolation. The vulnerability requires low privileges, high attack complexity, and user interaction, affecting the systemd init system across Linux distributions. No public exploit code or active exploitation has been confirmed at time of analysis.

RemediationAI

The primary fix is to upgrade systemd to version 260 or later. Users should apply this update through their distribution's package manager (apt, dnf, pacman, etc.). Detailed remediation guidance and security advisory information is available at https://github.com/systemd/systemd/security/advisories/GHSA-6pwp-j5vg-5j6m. Until patching is completed, system administrators should restrict local user access to systems running systemd 259 where possible, though no practical workaround fully mitigates the authorization bypass without code changes.

Affected VersionsENISA

systemd 259 <260

Affected Packages

euvd systemd fix: 260

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

systemd-machined is a system service that manages virtual machines and containers via the varlink RPC protocol. The vulnerability stems from CWE-863 (Incorrect Authorization), where varlink communication paths fail to properly validate namespace boundaries, allowing a low-privileged local user to bypass intended access controls and reach into the root namespace. The affected product is systemd (cpe:2.3:a:systemd:systemd:*:*:*:*:*:*:*:*), which serves as the init system and system manager for most modern Linux distributions. The flaw is specific to varlink's inter-process communication mechanism and how machined enforces namespace isolation when processing remote procedure calls.

Know when Systemd gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 6.7 MEDIUM
AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
SUSE MEDIUM
Red Hat 6.7 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Patch available
Apr 16, 2026 - 05:29 EUVD
260
CVE Published
Apr 10, 2026 - 15:14 nvd
MEDIUM 6.7

DescriptionCVE.org

In systemd 259 before 260, there is local privilege escalation in systemd-machined because varlink can be used to reach the root namespace.

Threat Intelligence Overview

EPSS Score
0.0%
Top 98% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact· derived
Medium
Technical Impact
Total

Priority Score

34
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +34
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.

Related Vulnerabilities in systemd Multiple Privilege Escalation and DoS

View all 6
CVE-2026-40223 MEDIUM
4.7
CVE-2026-40225 MEDIUM
6.4
CVE-2026-40226 MEDIUM
6.4
CVE-2026-40228 LOW
2.9
CVE-2026-40227 MEDIUM
6.2

More in Systemd

View all
CVE-2015-7510 CRITICAL POC
9.8 Sep 25

Stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd. Rated cr
CVE-2013-4391 HIGH POC
7.5 Oct 28

Integer overflow in the valid_user_field function in journal/journald-native.c in systemd allows remote attackers to cau
CVE-2023-26604 HIGH POC
7.8 Mar 03

systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible su
CVE-2016-10156 HIGH POC
7.8 Jan 23

A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd tim
CVE-2019-3844 HIGH POC
7.8 Apr 26

It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of

CVE-2019-3843 HIGH POC
7.8 Apr 26

It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allo
CVE-2018-15686 HIGH POC
7.8 Oct 26

A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution

CVE-2018-6954 HIGH POC
7.8 Feb 13

systemd-tmpfiles in systemd through 237 mishandles symlinks present in non-terminal path components, which allows local

CVE-2021-33910 MEDIUM POC
5.5 Jul 20

basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Val
CVE-2019-3842 HIGH POC
7.0 Apr 09

In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using t
CVE-2018-15687 HIGH POC
7.0 Oct 26

A race condition in chown_one() of systemd allows an attacker to cause systemd to set arbitrary permissions on arbitrary
CVE-2017-1000082 CRITICAL
9.8 Jul 07

systemd v233 and earlier fails to safely parse usernames starting with a numeric digit (e.g. Rated critical severity (CV

Same weakness CWE-863 – Incorrect Authorization

View all
CVE-2025-54253 CRITICAL POC
10.0
CVE-2025-24200 MEDIUM
6.1
CVE-2026-71362 CRITICAL POC
9.1
CVE-2026-42016 HIGH POC
8.8
CVE-2023-21715 HIGH
7.3
CVE-2025-21480 HIGH
8.6
CVE-2025-21479 HIGH
8.6
CVE-2025-32462 HIGH POC
8.8

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Fixed
SLES15-SP6-CHOST-BYOS Fixed
SLES15-SP6-CHOST-BYOS-Aliyun Fixed
SLES15-SP6-CHOST-BYOS-Azure Fixed
SLES15-SP6-CHOST-BYOS-EC2 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-40224 REF https://github.com/systemd/systemd/security/advisories/GHSA-6pwp-j5vg-5j6m

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy