CVE-2026-104619
Received Received - Intake

Security Update Rollback in PackageKit Zypp Backend

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: SUSE

Description
Untrusted users could roll back security updates when using the PackageKit Zypp Backend before 1.4.1, allowing privilege escalation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-104619
EUVD
EUVD-2026-120864

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
suse packagekit 1.4.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1328 Security-version number in hardware is mutable, resulting in the ability to downgrade (roll-back) the boot firmware to vulnerable code versions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows untrusted users to roll back security updates when using the PackageKit Zypp Backend before version 1.4.1. This could enable privilege escalation by reverting to a vulnerable state.

Impact Analysis

An attacker could exploit this to revert security updates, leaving systems exposed to known vulnerabilities. This may lead to unauthorized access or control over affected systems.

Mitigation Strategies

Update PackageKit Zypp Backend to version 1.4.1 or later to prevent untrusted users from rolling back security updates. This addresses the privilege escalation risk.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104619. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...