CVE-2026-91839
Received Received - Intake

NetworkManager-fortisslvpn VPN Profile Code Injection

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: Fedora Project

Description
A flaw was found in NetworkManager-fortisslvpn, the FortiSSLVPN plugin for NetworkManager. The nm-fortisslvpn-service improperly handles carriage-return/line-feed (CR/LF) characters in VPN connection profile credentials. A local unprivileged user can exploit this by crafting a malicious VPN profile to inject additional configuration directives. This can lead to arbitrary code execution with root privileges when the crafted VPN connection is activated.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-26
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-91839
EUVD
EUVD-2026-87249

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
fortinet fortisslvpn *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-93 The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in NetworkManager-fortisslvpn, a plugin for managing FortiSSLVPN connections. It involves improper handling of CR/LF characters in VPN profile credentials. A local attacker can craft a malicious profile to inject configuration commands, leading to root-level code execution when the VPN connection is activated.

Detection Guidance

This vulnerability involves improper handling of CR/LF characters in VPN profile credentials by nm-fortisslvpn-service. To detect it, inspect VPN connection profiles for unexpected CR/LF characters in credential fields. Check logs for unusual configuration directives during VPN activation. No specific commands are provided in the context.

Impact Analysis

If you use NetworkManager-fortisslvpn, an attacker with local access could exploit this to gain full control of your system. This includes stealing data, installing malware, or disrupting operations. The attack requires local access but no special privileges.

Compliance Impact

This vulnerability could lead to unauthorized system access, potentially violating data protection requirements under GDPR or HIPAA. Organizations using affected systems may face compliance failures if attackers exfiltrate sensitive data or gain control of regulated systems.

Mitigation Strategies

Update NetworkManager-fortisslvpn to the latest patched version immediately to prevent exploitation via crafted VPN profiles.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91839. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart