Vulnerability · Published Jun 16, 2026 · Assigned by suse
CVE-2026-44932indirect remote shell command injection via unsanitized DHCP options in wicked
High 8.8
In plain English
A high-severity OS command injection in wicked from SUSE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.4%top 70.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Passing of unsanitized strings from DHCP replies into the wicked dhcp client before wicked 0.6.79 could be used by attackers operating a malicious DHCP server to execute code on the local machine.
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://bugzilla.suse.com/show_bug.cgi?id=1265221 issue-tracking
- https://github.com/openSUSE/wicked/releases/tag/version-0.6.79 release-notes
- https://lists.suse.com/pipermail/sle-security-updates/2026-June/026688.html vendor-advisory
- https://lists.suse.com/pipermail/sle-security-updates/2026-June/026689.html vendor-advisory
- https://lists.suse.com/pipermail/sle-security-updates/2026-June/026690.html vendor-advisory
- https://lists.suse.com/pipermail/sle-security-updates/2026-June/026691.html vendor-advisory