{"id":"CVE-2026-19685","aliases":["DEBIAN-CVE-2026-19685","EUVD-2026-64957","GHSA-xpm4-qfqg-g2wr","OESA-2026-3661","OESA-2026-3662","OESA-2026-3663","OESA-2026-3664","OESA-2026-3713","SUSE-SU-2026:23475-1","SUSE-SU-2026:23499-1","SUSE-SU-2026:23525-1","SUSE-SU-2026:23639-1","SUSE-SU-2026:23656-1","SUSE-SU-2026:4063-1","SUSE-SU-2026:4066-1","SUSE-SU-2026:4067-1","SUSE-SU-2026:4144-1","SUSE-SU-2026:4148-1","UBUNTU-CVE-2026-19685","USN-8806-1","openSUSE-SU-2026:11693-1","openSUSE-SU-2026:21776-1"],"status":"published","title":"Networkmanager: networkmanager: 802-1x ca-path and phase2-ca-path bypass private_user restriction, allowing wpa-enterprise server validation bypass (incomplete fix for cve-2025-9615)","description":"NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise (802.1X) connection profile's CA path at an attacker-controlled directory, bypassing server certificate validation and enabling credential theft via a rogue access point.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00237,"percentile":0.14871,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2026-08-24T16:12:38Z","modified":"2026-11-06T01:07:16Z","fixes":[{"ecosystem":"Debian:14","package":"network-manager","fixed_in":["1.58.1-1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"NetworkManager","fixed_in":["1.32.12-26.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"NetworkManager","fixed_in":["1.44.2-9.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"NetworkManager","fixed_in":["1.44.2-9.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"NetworkManager","fixed_in":["1.26.2-19.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"NetworkManager","fixed_in":["1.44.2-9.oe2403sp4"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"network-manager","fixed_in":["1.54.3-2ubuntu3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:14","package":"network-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.58.1-1"}]}],"versions":["1.52.1-1","1.54.0-1","1.54.0-2","1.54.0-3","1.54.0-4","1.54.1-1","1.54.2-1","1.54.2-2","1.54.2-3","1.54.3-1","1.54.3-2","1.56.0-1","1.56.0-2","1.56.0-3","1.56.0-4","1.56.0-5","1.56.0-6","1.56.0-7","1.56.1-1","1.58.0-1","1.58.0-2","1.58.0-3","1.58~rc1-1"]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"NetworkManager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.32.12-26.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"NetworkManager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.44.2-9.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"NetworkManager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.44.2-9.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"NetworkManager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-19.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"NetworkManager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.44.2-9.oe2403sp4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"NetworkManager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.42.6-9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"NetworkManager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.52.0-160000.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"NetworkManager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.42.6-slfo.1.1_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"NetworkManager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.52.0-160000.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"NetworkManager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.52.0-160000.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"NetworkManager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.52.0-160000.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"NetworkManager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.52.0-160000.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"NetworkManager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.38.6-150500.3.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"NetworkManager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.38.6-150500.3.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"NetworkManager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.38.6-150500.3.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"NetworkManager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.38.6-150500.3.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"NetworkManager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.38.6-150500.3.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"NetworkManager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.38.2-150400.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"NetworkManager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.38.2-150400.3.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"NetworkManager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.32.12-150400.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"NetworkManager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.32.12-150400.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"NetworkManager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.32.12-150400.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"NetworkManager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.32.12-150400.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"NetworkManager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.44.2-150600.3.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"NetworkManager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.44.2-150600.3.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"NetworkManager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.44.2-150600.3.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"NetworkManager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.44.2-150600.3.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"NetworkManager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.44.2-150600.3.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"network-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.54.3-2ubuntu3.1"}]}],"versions":["1.52.0-1ubuntu3","1.52.0-1ubuntu4","1.54.2-2ubuntu1","1.54.2-2ubuntu2","1.54.3-2ubuntu1","1.54.3-2ubuntu2","1.54.3-2ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"network-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.54.3-2ubuntu3.1"}]}],"versions":["1.52.0-1ubuntu3","1.52.0-1ubuntu4","1.54.2-2ubuntu1","1.54.2-2ubuntu2","1.54.3-2ubuntu1","1.54.3-2ubuntu2","1.54.3-2ubuntu3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"NetworkManager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.56.1-4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"NetworkManager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.52.0-160000.5.1"}]}],"bundled":2}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift container platform 5"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-19685","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515042","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/commit/a8e87381a3e70060abd721d9a347f42b2ba68e6e","tags":["fix"]},{"url":"https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/commit/e85cc46d0b36cdba50fe8411cc93d55a49ebfccf","tags":["fix"]},{"url":"https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2513","tags":["fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19685","tags":["advisory"]},{"url":"https://redhat.atlassian.net/browse/PSIRTSUPT-20440"},{"url":"https://github.com/advisories/GHSA-xpm4-qfqg-g2wr"},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19685.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-19685","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3661","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3662","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3663","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3664","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3713","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623475-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1267696","tags":["report"]},{"url":"https://bugzilla.suse.com/1276764","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-10805","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-19685","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623499-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623525-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623639-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623656-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264063-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1224868","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264066-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264067-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264144-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264148-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-19685","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-19685","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8806-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-19685","title":"Networkmanager: networkmanager: 802-1x ca-path and phase2-ca-path bypass private_user restriction, allowing wpa-enterprise server validation bypass (incomplete fix for cve-2025-9615)","description":"NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise (802.1X) connection profile's CA path at an attacker-controlled directory, bypassing server certificate validation and enabling credential theft via a rogue access point.","status":"published","published":"2026-08-24T16:12:38.297Z","modified":"2026-11-04T22:12:10.233Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-863"],"updated_at":"2026-11-04T23:40:09.798467Z"}],"euvd":[{"id":"EUVD-2026-64957","description":"NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise (802.1X) connection profile's CA path at an attacker-controlled directory, bypassing server certificate validation and enabling credential theft via a rogue access point.","status":"published","published":"2026-08-24T16:12:38Z","modified":"2026-11-04T22:12:10Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-04T23:47:18.620008Z"}],"ghsa":[{"id":"GHSA-xpm4-qfqg-g2wr","title":"NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca...","description":"NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise (802.1X) connection profile's CA path at an attacker-controlled directory, bypassing server certificate validation and enabling credential theft via a rogue access point.","status":"published","published":"2026-08-24T18:31:51Z","modified":"2026-08-24T21:34:43Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:10:55.456762Z"}],"nvd":[{"id":"CVE-2026-19685","description":"NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise (802.1X) connection profile's CA path at an attacker-controlled directory, bypassing server certificate validation and enabling credential theft via a rogue access point.","status":"published","published":"2026-08-24T17:17:21.907Z","modified":"2026-11-04T23:17:25.17Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-05T01:45:10.861521Z"}],"osv":[{"id":"CVE-2026-19685","title":"Networkmanager: networkmanager: 802-1x ca-path and phase2-ca-path bypass private_user restriction, allowing wpa-enterprise server validation bypass (incomplete fix for cve-2025-9615)","description":"NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise (802.1X) connection profile's CA path at an attacker-controlled directory, bypassing server certificate validation and enabling credential theft via a rogue access point.","status":"published","published":"2026-08-24T16:12:38.297Z","modified":"2026-11-06T01:07:16.408381819Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-06T01:32:47.895286Z"},{"id":"DEBIAN-CVE-2026-19685","description":"NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise (802.1X) connection profile's CA path at an attacker-controlled directory, bypassing server certificate validation and enabling credential theft via a rogue access point.","status":"published","published":"2026-08-24T17:17:21.907Z","modified":"2026-11-05T09:47:25.84468916Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-05T13:31:49.170436Z"},{"id":"OESA-2026-3661","title":"NetworkManager security update","description":"NetworkManager attempts to keep an active network connection available at all times.  The point of NetworkManager is to make networking configuration and setup as painless and automatic as possible. If using DHCP, NetworkManager is intended to replace default routes, obtain IP addresses from a DHCP server, and change name servers whenever it sees fit.\r\n\r\nSecurity Fix(es):\n\nNetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise (802.1X) connection profile\u0026apos;s CA path at an attacker-controlled directory, bypassing server certificate validation and enabling credential theft via a rogue access point.(CVE-2026-19685)","status":"published","published":"2026-09-05T15:03:38Z","modified":"2026-09-05T15:16:34.693973047Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3662","title":"NetworkManager security update","description":"NetworkManager attempts to keep an active network connection available at all times.  The point of NetworkManager is to make networking configuration and setup as painless and automatic as possible. If using DHCP, NetworkManager is intended to replace default routes, obtain IP addresses from a DHCP server, and change name servers whenever it sees fit.\r\n\r\nSecurity Fix(es):\n\nNetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise (802.1X) connection profile\u0026apos;s CA path at an attacker-controlled directory, bypassing server certificate validation and enabling credential theft via a rogue access point.(CVE-2026-19685)","status":"published","published":"2026-09-05T15:03:39Z","modified":"2026-09-05T15:16:34.687136704Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3663","title":"NetworkManager security update","description":"NetworkManager attempts to keep an active network connection available at all times.  The point of NetworkManager is to make networking configuration and setup as painless and automatic as possible. If using DHCP, NetworkManager is intended to replace default routes, obtain IP addresses from a DHCP server, and change name servers whenever it sees fit.\r\n\r\nSecurity Fix(es):\n\nNetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise (802.1X) connection profile\u0026apos;s CA path at an attacker-controlled directory, bypassing server certificate validation and enabling credential theft via a rogue access point.(CVE-2026-19685)","status":"published","published":"2026-09-05T15:03:40Z","modified":"2026-09-05T15:16:35.49309278Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3664","title":"NetworkManager security update","description":"NetworkManager attempts to keep an active network connection available at all times.  The point of NetworkManager is to make networking configuration and setup as painless and automatic as possible. If using DHCP, NetworkManager is intended to replace default routes, obtain IP addresses from a DHCP server, and change name servers whenever it sees fit.\r\n\r\nSecurity Fix(es):\n\nNetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise (802.1X) connection profile\u0026apos;s CA path at an attacker-controlled directory, bypassing server certificate validation and enabling credential theft via a rogue access point.(CVE-2026-19685)","status":"published","published":"2026-09-05T15:03:41Z","modified":"2026-09-05T15:16:34.992041269Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3713","title":"NetworkManager security update","description":"NetworkManager attempts to keep an active network connection available at all times.  The point of NetworkManager is to make networking configuration and setup as painless and automatic as possible. If using DHCP, NetworkManager is intended to replace default routes, obtain IP addresses from a DHCP server, and change name servers whenever it sees fit.\r\n\r\nSecurity Fix(es):\n\nNetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise (802.1X) connection profile\u0026apos;s CA path at an attacker-controlled directory, bypassing server certificate validation and enabling credential theft via a rogue access point.(CVE-2026-19685)","status":"published","published":"2026-09-14T16:33:38Z","modified":"2026-09-13T16:45:31.033600317Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"UBUNTU-CVE-2026-19685","description":"NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise (802.1X) connection profile's CA path at an attacker-controlled directory, bypassing server certificate validation and enabling credential theft via a rogue access point.","status":"published","published":"2026-08-24T17:17:00Z","modified":"2026-09-24T02:11:40.373261167Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:56:01.334185Z"},{"id":"openSUSE-SU-2026:11693-1","title":"NetworkManager-1.56.1-4.1 on GA media","description":"These are all security issues fixed in the NetworkManager-1.56.1-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-07T00:00:00Z","modified":"2026-09-08T09:00:05.98562634Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21776-1","title":"Security update for NetworkManager","description":"This update for NetworkManager fixes the following issues:\n\n- CVE-2026-10805: local privilege escalation via malformed MUD URLs in dhclient backend (bsc#1267696).\n- CVE-2026-19685: missing user ownership checks for 802.1X directory properties can allow WPA-Enterprise server\n  certificate validation bypass (bsc#1276764).\n","status":"published","published":"2026-09-06T17:07:25Z","modified":"2026-09-09T18:23:15.277304896Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23475-1","title":"Security update for NetworkManager","description":"This update for NetworkManager fixes the following issues:\n\n- CVE-2026-10805: local privilege escalation via malformed MUD URLs in dhclient backend (bsc#1267696).\n- CVE-2026-19685: missing user ownership checks for 802.1X directory properties can allow WPA-Enterprise server\n  certificate validation bypass (bsc#1276764).\n","status":"published","published":"2026-09-08T09:48:42Z","modified":"2026-09-14T18:23:16.685343235Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23499-1","title":"Security update for NetworkManager","description":"This update for NetworkManager fixes the following issues:\n\n- CVE-2026-10805: local privilege escalation via malformed MUD URLs in dhclient backend (bsc#1267696).\n- CVE-2026-19685: missing user ownership checks for 802.1X directory properties can allow WPA-Enterprise server\n  certificate validation bypass (bsc#1276764).\n","status":"published","published":"2026-09-06T17:07:58Z","modified":"2026-09-14T18:23:13.959087898Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23525-1","title":"Security update for NetworkManager","description":"This update for NetworkManager fixes the following issues:\n\n- CVE-2026-10805: local privilege escalation via malformed MUD URLs in dhclient backend (bsc#1267696).\n- CVE-2026-19685: missing user ownership checks for 802.1X directory properties can allow WPA-Enterprise server\n  certificate validation bypass (bsc#1276764).\n","status":"published","published":"2026-09-08T09:16:06Z","modified":"2026-09-15T18:23:09.094104553Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23639-1","title":"Security update for NetworkManager","description":"This update for NetworkManager fixes the following issues:\n\n- CVE-2026-10805: local privilege escalation via malformed MUD URLs in dhclient backend (bsc#1267696).\n- CVE-2026-19685: missing user ownership checks for 802.1X directory properties can allow WPA-Enterprise server\n  certificate validation bypass (bsc#1276764).\n","status":"published","published":"2026-09-06T17:07:58Z","modified":"2026-09-29T18:23:10.394811634Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23656-1","title":"Security update for NetworkManager","description":"This update for NetworkManager fixes the following issues:\n\n- CVE-2026-10805: local privilege escalation via malformed MUD URLs in dhclient backend (bsc#1267696).\n- CVE-2026-19685: missing user ownership checks for 802.1X directory properties can allow WPA-Enterprise server\n  certificate validation bypass (bsc#1276764).\n","status":"published","published":"2026-09-06T17:07:58Z","modified":"2026-09-29T18:23:11.193751511Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:4063-1","title":"Security update for NetworkManager","description":"This update for NetworkManager fixes the following issues:\n\n- CVE-2026-10805: local privilege escalation via malformed MUD URLs in dhclient backend (bsc#1267696).\n- CVE-2026-19685: missing user ownership checks for 802.1X directory properties can allow WPA-Enterprise server\n  certificate validation bypass (bsc#1276764).\n\nChanges for NetworkManager:\n\n- Add config-server subpackage (bsc#1224868).\n","status":"published","published":"2026-09-08T07:02:26Z","modified":"2026-09-13T18:23:19.464763385Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4066-1","title":"Security update for NetworkManager","description":"This update for NetworkManager fixes the following issues:\n\n- CVE-2026-10805: local privilege escalation via malformed MUD URLs in dhclient backend (bsc#1267696).\n- CVE-2026-19685: missing user ownership checks for 802.1X directory properties can allow WPA-Enterprise server\n  certificate validation bypass (bsc#1276764).\n","status":"published","published":"2026-09-08T07:03:22Z","modified":"2026-09-13T18:23:19.672780354Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4067-1","title":"Security update for NetworkManager","description":"This update for NetworkManager fixes the following issues:\n\n- CVE-2026-10805: local privilege escalation via malformed MUD URLs in dhclient backend (bsc#1267696).\n- CVE-2026-19685: missing user ownership checks for 802.1X directory properties can allow WPA-Enterprise server\n  certificate validation bypass (bsc#1276764).\n","status":"published","published":"2026-09-08T07:03:48Z","modified":"2026-09-13T18:23:19.665969263Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4144-1","title":"Security update for NetworkManager","description":"This update for NetworkManager fixes the following issues:\n\n- CVE-2026-10805: Local privilege escalation via malformed MUD URLs in dhclient backend (bsc#1267696).\n- CVE-2026-19685: missing user ownership checks for 802.1X directory properties can allow WPA-Enterprise server\n  certificate validation bypass (bsc#1276764).\n","status":"published","published":"2026-09-14T08:00:00Z","modified":"2026-09-15T17:00:04.821649516Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4148-1","title":"Security update for NetworkManager","description":"This update for NetworkManager fixes the following issues:\n\n- CVE-2026-10805: Local privilege escalation via malformed MUD URLs in dhclient backend (bsc#1267696).\n- CVE-2026-19685: missing user ownership checks for 802.1X directory properties can allow WPA-Enterprise server\n  certificate validation bypass (bsc#1276764).\n","status":"published","published":"2026-09-14T08:01:55Z","modified":"2026-09-15T17:00:05.44563248Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"USN-8806-1","title":"network-manager vulnerability","description":"It was discovered that NetworkManager did not properly restrict the\nca-path and phase2-ca-path certificate authority settings for private\n(single-user) 802.1X network connections. An attacker could use this issue\nto point their own private 802.1X connection profile at a directory under\ntheir control, causing NetworkManager to trust an attacker-chosen\ncertificate authority and potentially exposing network credentials via a\nrogue authentication server.","status":"published","published":"2026-09-23T13:24:45Z","modified":"2026-09-24T02:12:34.837174995Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}