High severity · published Sep 25, 2026
CVE-2026-91840
Networkmanager-vpnc: networkmanager-vpnc: local privilege escalation to root via newline injection in vpn username
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
A flaw was found in NetworkManager-vpnc. This vulnerability allows a local unprivileged user to escalate privileges to root. By injecting a newline character into the VPN username field, an attacker can manipulate the vpnc configuration to execute an arbitrary program with root privileges when the malicious VPN connection is activated.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
NetworkManager-vpnc · GNOME
0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-91840
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-91840
vdb-entry
https://access.redhat.com/security/cve/CVE-2026-91840
issue-tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2533642
gitlab.gnome.org
https://gitlab.gnome.org/Archive/NetworkManager-vpnc/-/work_items/19
More from NetworkManager-vpnc
7.8
CVE-2026-91841
Networkmanager-vpnc: networkmanager-vpnc: incomplete fix for cve-2018-10900 allows root privilege escalation via ca-file path newline injection