CVE-2026-75131
Received Received - Intake

Privilege Escalation in NetworkManager-l2tp via pppd Injection

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: VulnCheck

Description
NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains a privilege escalation vulnerability that allows local users with permission to create VPN connections to execute arbitrary code as root by injecting pppd options through a crafted VPN username. Attackers can embed a double-quote character or whitespace in the username to break out of the pppd options file quoting context and include the pppd plugin directive, causing the privileged pppd process to load an attacker-controlled shared object.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-24
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-75131
EUVD
EUVD-2026-85526

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
networkmanager networkmanager-l2tp From 1.52.4 (inc) to 1.52.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-88 The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-75131 is a local privilege escalation flaw in NetworkManager-l2tp versions up to 1.52.4. It allows a local attacker with VPN connection creation rights to inject malicious pppd options via a crafted username. By embedding quotes or whitespace, the attacker can escape the options file context and force pppd to load a malicious shared object, executing arbitrary code as root.

Detection Guidance

To detect this vulnerability, check the installed version of NetworkManager-l2tp. If it is 1.52.4 or earlier, including certain 1.20.x and 1.8.x branches, the system is vulnerable. Run: networkmanager-l2tp --version or check package managers like apt, dnf, or pacman for the installed version.

Impact Analysis

If you have permission to create VPN connections on a vulnerable system, an attacker could exploit this to gain root access. This could lead to full system compromise, data theft, or installation of malware. The attack requires minimal initial permissions and can be executed locally.

Compliance Impact

This vulnerability could lead to unauthorized root access, potentially violating data confidentiality and integrity requirements in GDPR and HIPAA. A successful exploit may result in data breaches, unauthorized access to sensitive information, and non-compliance with security controls requiring privileged access management.

Mitigation Strategies

Immediately upgrade NetworkManager-l2tp to version 1.52.6 or later. If upgrading is not possible, disable the ability for users to create or modify VPN connections as a temporary workaround. Monitor official advisories for patches or updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75131. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart