Loading story…
Researchers disclosed CVE-2026-32746, a critical telnetd vulnerability in GNU Inetutils that allows an unauthenticated remote attacker to achieve root remote code execution by exploiting a buffer overflow in the LINEMODE SLC (Set Local Characters) option handler. The flaw affects GNU Inetutils telnetd through version 2.7, carries a CVSS 9.8, and can be triggered during the initial Telnet handshake on port 23 before any login prompt appears, requiring no credentials, no user interaction, and no special network position.
The issue was discovered and reported by Dream on March 11, 2026, and GNU maintainers reportedly confirmed the finding, with a fix expected by April 1, 2026. Both reports warn that successful exploitation can lead to full system compromise because telnetd often runs with elevated privileges, enabling follow-on activity such as persistent backdoors, data theft, and lateral movement. The risk is especially acute in legacy environments where Telnet remains in use, including ICS/OT, PLC, SCADA, and some government systems, even though public reporting has not yet indicated active exploitation in the wild.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
GNU announced the stable release of inetutils 2.8 on 2026-04-29, delivering the upstream fix for the telnetd RCE flaw CVE-2026-32746. The release also addressed telnetd authentication bypass CVE-2026-24061, mitigated privilege-escalation issue CVE-2026-28372, and included additional telnet/telnetd hardening changes.
Debian published security advisory DSA 6193-1 announcing a security update for inetutils to address the telnetd vulnerability tracked as CVE-2026-32746. The advisory marks a downstream distribution patch release following earlier disclosure and analysis of the flaw.
Public disclosures stated that the official GNU InetUtils release containing the fix for CVE-2026-32746 was expected on 2026-04-01. This was presented as the anticipated patch date rather than a confirmed release at the time of reporting.
Synology warned that CVE-2026-32746 affects DiskStation Manager and related products via the GNU InetUtils telnetd daemon, exposing systems to unauthenticated command execution. The company released fixes for DSM 7.3, 7.2.2, and 7.2.1, said a DSMUC 3.1 fix was still in development, and advised customers to disable Telnet as a mitigation.
watchTowr Labs released a deeper technical analysis showing the bug dates back to 1994, affects GNU inetutils-telnetd and downstream implementations, and can yield impactful exploitation primitives even if universal RCE was not achieved. The researchers also published a detection artifact generator and noted that Debian sid/forky had fixes while many other distributions still had not shipped patches.
Multiple outlets reported the public disclosure of CVE-2026-32746, an unauthenticated root-level RCE in GNU InetUtils telnetd caused by an out-of-bounds write or buffer overflow in LINEMODE SLC negotiation during the Telnet handshake. The flaw affects all telnetd versions through 2.7 and was described as trivial to trigger with crafted traffic to port 23 before authentication.
Following the report, GNU InetUtils maintainers confirmed the telnetd vulnerability and approved a fix for release. Public reporting said an official patched release was expected on 2026-04-01.
Dream Security discovered and reported CVE-2026-32746, a critical pre-authentication remote code execution flaw in GNU InetUtils telnetd, to the project maintainers. The report was submitted on 2026-03-11, according to later public disclosures.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
11 references tracked. Mallory keeps watching after this page renders.
my.f5.com
Open sourcecyber.gc.ca
Open sourcelists.debian.org
Open sourcecybersecuritynews.com
Open sourcecybersecuritynews.com
Open sourcegbhackers.com
Open sourcecvereports.com
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability tracked as **CVE-2026-32746** was disclosed in **GNU InetUtils `telnetd`** affecting version **2.7 and earlier**, enabling **pre-authentication remote code execution** through a buffer overflow in the **LINEMODE SLC handler**. The flaw stems from a missing bounds check in the `add_slc` function, which can trigger an out-of-bounds memory write during the Telnet handshake before the login prompt is shown. Security reporting said a remote unauthenticated attacker could exploit the bug to execute code as **root**, resulting in full system compromise. The issue was rated **CVSS 9.8** and public proof-of-concept exploit code was reported as available, increasing the likelihood of exploitation against exposed Telnet services. Advisories urged organizations to treat internet-accessible `telnetd` instances as high risk and apply mitigations until patches are available, including restricting access to trusted IP addresses, blocking **TCP port 23**, or disabling Telnet entirely where it is not operationally required.
Jul 24, 2026
GNU InetUtils disclosed **CVE-2026-24061**, a high-severity authentication bypass in `telnetd` that can let a remote client obtain **root** access without valid credentials. The bug affects versions **1.9.3 through 2.7** and stems from `telnetd` passing a client-controlled `USER` environment variable to `/usr/bin/login` without sanitization; a crafted value such as `-f root` can cause `login(1)` to skip normal authentication. The vulnerable code path was traced to a 2015 commit later shipped in the 1.9.3 release, and maintainers published patches while advising organizations not to run `telnetd`, to restrict access to trusted clients, and to upgrade to a fixed release. Public attention quickly expanded beyond the advisory as security researchers and developers published multiple **proof-of-concept exploits, scanners, Nuclei templates, test harnesses, and detection content** on GitHub and in vendor repositories. Those references describe tooling for discovery and exploitation of the `NEW_ENVIRON`/`USER` injection path, including lab environments and root-shell demonstrations, increasing the likelihood of opportunistic targeting against exposed Telnet services. The combination of a remotely reachable root bypass and rapidly available offensive tooling makes internet-facing or internally exposed GNU InetUtils `telnetd` instances an urgent remediation priority.
Jun 29, 2026
GNU InetUtils disclosed a high-severity authentication bypass in `telnetd`, tracked as **CVE-2026-24061**, that allows a remote attacker to obtain a root shell by abusing how the daemon invokes `/usr/bin/login`. In affected versions **1.9.3 through 2.7**, `telnetd` passes the client-controlled `USER` environment variable without proper sanitization, enabling an attacker to supply values such as `-f root` and trigger login’s authentication-bypass behavior. The flaw was reportedly introduced by a 2015 code change, remained present for more than a decade, and carries a **CVSS 9.8** severity rating. GNU InetUtils published patches to sanitize variable expansions used in the login invocation, including a broader hardening change after the initial fix, and advised administrators to upgrade or apply the available patches immediately. Where patching is not possible, maintainers and CSIRT.SK recommended disabling `telnetd`, restricting Telnet access to trusted IP addresses, considering a `login(1)` implementation that rejects the `-f` flag, and reviewing logs for signs of compromise. CSIRT.SK also reported that **GreyNoise observed exploitation attempts in the wild**, increasing the urgency for exposed systems.
Jul 24, 2026