Vulnerability · Published Sep 25, 2026 · Assigned by fedora

CVE-2026-91839Networkmanager-fortisslvpn: networkmanager-fortisslvpn: local privilege escalation to root via crlf injection in vpn profile credentials

High 7.8

In plain English

A high-severity security flaw in NetworkManager-fortisslvpn from GNOME. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.2%top 89.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in NetworkManager-fortisslvpn, the FortiSSLVPN plugin for NetworkManager. The nm-fortisslvpn-service improperly handles carriage-return/line-feed (CR/LF) characters in VPN connection profile credentials. A local unprivileged user can exploit this by crafting a malicious VPN profile to inject additional configuration directives. This can lead to arbitrary code execution with root privileges when the crafted VPN connection is activated.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	network-manager-fortisslvpn	no fix listed	DEBIAN-CVE-2026-91839
Ubuntu:22.04:LTS	network-manager-fortisslvpn	no fix listed	UBUNTU-CVE-2026-91839
Ubuntu:24.04:LTS	network-manager-fortisslvpn	no fix listed	UBUNTU-CVE-2026-91839

Affected products (as reported)

Vendor	Product	Versions
GNOME	NetworkManager-fortisslvpn	0 – before *

Weakness: CWE-93 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://access.redhat.com/security/cve/CVE-2026-91839 vdb-entry, x_refsource_REDHAT
RHBZ#2533640 issue-tracking, x_refsource_REDHAT
https://gitlab.gnome.org/Archive/NetworkManager-fortisslvpn/-/work_items/80