9.8
Critical
Exploited
CVE-2026-24061 GNU InetUtils Argument Injection Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Ransomware campaigns
Not observed so far
Weakness
CWE-88
Description
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Inetutils 1.9 | 1.9.3 → 2.7 | No fix stated |
References
- www.openwall.com www.openwall.com
- www.openwall.com www.openwall.com
- www.gnu.org www.gnu.org
- lists.gnu.org lists.gnu.org
- codeberg.org codeberg.org
- codeberg.org codeberg.org
- www.vicarius.io www.vicarius.io
- www.vicarius.io www.vicarius.io
- redteam.ae redteam.ae
Timeline
- Published
- Added to the KEV catalogue
- Last modified
Other CVEs of Inetutils
The 4 CVEs of Inetutils →
CVE-2026-32772
telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via…
3.4
Low
CVE-2026-32746
telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters)…
9.8
Critical
CVE-2026-28372
telnetd in GNU inetutils through 2.7 allows privilege escalation that can be exploited by abusing systemd service…
7.4
High