Vulnerability · Published Sep 17, 2026 · Assigned by VulnCheck

CVE-2026-93337NetworkManager-l2tp Privilege Escalation via pppd Plugin Injection

High 7.8

In plain English

A high-severity argument injection in NetworkManager-l2tp from nm-l2tp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.1%top 95.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains an improper input validation vulnerability that allows local users with VPN connection creation permissions to inject arbitrary pppd directives by supplying mru or mtu property values containing trailing non-numeric content after a valid integer. Attackers can exploit the verbatim write of unvalidated strings into the pppd options file via write_config_option() to inject the plugin directive, causing the privileged pppd process to load an attacker-controlled shared object and achieve arbitrary code execution as root.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	network-manager-l2tp	1.20.8-1+deb12u1	DEBIAN-CVE-2026-93337
Debian:13	network-manager-l2tp	1.20.20-2+deb13u1	DEBIAN-CVE-2026-93337
Debian:14	network-manager-l2tp	1.52.6-1	DEBIAN-CVE-2026-93337
Ubuntu:22.04:LTS	network-manager-l2tp	no fix listed	UBUNTU-CVE-2026-93337
Ubuntu:24.04:LTS	network-manager-l2tp	no fix listed	UBUNTU-CVE-2026-93337
Ubuntu:26.04:LTS	network-manager-l2tp	no fix listed	UBUNTU-CVE-2026-93337

Affected products (as reported)

Vendor	Product	Versions
nm-l2tp	NetworkManager-l2tp	0 – through 1.52.4

Weakness: CWE-88 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-rp84-8h2r-5xc3) vendor-advisory
Patch Commit patch
https://www.vulncheck.com/advisories/networkmanager-l2tp-privilege-escalation-via-pppd-plugin-injection third-party-advisory