Loading story…
Red Hat and SUSE disclosed DHCP-related command injection flaws that can let an attacker on the same or adjacent network execute code during system boot. CVE-2026-6893 affects dracut's legacy networking path, where DHCP-supplied values such as host-name are written into temporary shell scripts by modules.d/35network-legacy/dhclient-script.sh and later sourced as root inside initramfs. On systems booting with configurations such as ip=dhcp and rd.neednet=1, a malicious DHCP server can abuse the legacy dhclient flow to achieve root code execution before the operating system fully starts.
SUSE separately assigned CVE-2026-44932 to wicked, which writes DHCP option values into /run/wicked/leaseinfo.* files without sufficient sanitization. Although wicked does not directly source those files, downstream scripts and components that do can execute attacker-controlled shell metacharacters delivered in DHCP responses, creating an indirect remote shell injection path that SUSE said can reach root-level execution in components including dracut's network-legacy module on SLE 15 SP7. Both disclosures tie the risk to unsafe handling of untrusted DHCP data in early-boot networking, and SUSE said it issued security updates across affected product lines.
Get the actors, campaigns, and ATT&CK mapping behind it.
8 events from the most recent confirmed update back to the earliest known activity.
Red Hat published RHSA-2026:61252 for RHEL 8, including supported 8.8 E4S and TUS configurations, with Important-rated updates for dracut and dracut-network. The advisory addresses CVE-2026-6893, CVE-2026-15816, and CVE-2026-16445, a command-injection issue in dracut's NetworkManager initrd module that can allow root code execution via DHCP options.
Red Hat published advisory RHSA-2026:57785 for Red Hat Enterprise Linux 9.4 Extended Update Support, providing dracut security updates for CVE-2026-6893 and CVE-2026-15816. The advisory was rated Important and covered affected dracut-network packages on RHEL 9.4 EUS.
Red Hat published advisory RHSA-2026:57775 for dracut on Red Hat Enterprise Linux 9.2 E4S, addressing CVE-2026-6893 and CVE-2026-15816. The advisory was rated Important and covered affected dracut and dracut-network packages.
Red Hat published advisory RHSA-2026:57772 for RHEL 9, including RHEL EUS 9.6, providing dracut and dracut-network security updates for CVE-2026-6893 and CVE-2026-15816. The advisory rated the issues Important and addressed root code execution risks in dracut's DHCP handling and emergency hook script logic.
Red Hat published advisory RHSA-2026:57580 for RHEL 10 and RHEL EUS 10.0, providing dracut security updates that address CVE-2026-6893 and CVE-2026-15816. The advisory rated the issues Important and identified affected dracut and dracut-network packages.
A Red Hat Bugzilla report documented CVE-2026-15816 in dracut's die() function, where an unescaped error message written to 01-die.sh could allow DHCP-controlled ROOT_PATH data to trigger root command execution when emergency hook scripts are later sourced. The report states the issue is distinct from CVE-2026-6893 and was reproduced across shipped dracut RPMs from RHEL 6 through RHEL 10.
A SUSE Bugzilla report disclosed CVE-2026-44932 in wicked, where insufficiently sanitized DHCP option values written to leaseinfo files could lead to indirect shell command injection when sourced by downstream scripts or modules. The report states SUSE published multiple important security updates across affected product lines to address the issue.
A Red Hat Bugzilla report documented CVE-2026-6893 in dracut's legacy DHCP path, describing how DHCP-supplied values could be written into temporary shell scripts and later sourced as root in initramfs, enabling root code execution from a malicious DHCP server on the same Layer 2 segment.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
13 references tracked. Mallory keeps watching after this page renders.
tenable.com
Open sourcetenable.com
Open sourcetenable.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.suse.com
Open sourcebugzilla.redhat.com
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The FreeBSD Project disclosed **CVE-2026-42511**, a critical vulnerability in the default IPv4 DHCP client, `dhclient(8)`, that can allow a local network attacker to execute arbitrary code as **root**. The flaw arises because `dhclient(8)` does not properly escape double quotes in the BOOTP file field before writing data to the DHCP lease file, allowing a malicious DHCP response to inject configuration content that is later re-parsed and executed by `dhclient-script(8)`. Exploitation requires the attacker to be on the same broadcast domain and operate a rogue DHCP server that replies with crafted DHCP data. FreeBSD said the issue affects all currently supported branches, including **FreeBSD 15.0, 14.4, 14.3, and 13.5** release and stable versions, and published patches in security advisory **FreeBSD-SA-26:12.dhclient**. Administrators were urged to update immediately, and FreeBSD noted that switch-level **DHCP snooping** can help mitigate attacks from rogue DHCP servers where continued use of `dhclient` is necessary.
Jun 29, 2026
OpenWrt released **v25.12.5** with urgent fixes for multiple security issues in default-enabled network services, including **CVE-2026-62948**, a flaw that lets an unauthenticated DHCPv6 client inject forged lines into `/tmp/odhcpd.leases` through the FQDN hostname option. Those injected entries can later be rendered as live HTML in the **LuCI** “Active DHCPv6 Leases” page, creating a stored cross-site scripting path against administrators who view the interface. The vulnerability affects OpenWrt versions prior to **25.12.5** and carries a high-impact `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H` rating. The service release also patches additional vulnerabilities across **odhcpd**, **uhttpd**, **LuCI**, **cgi-io**, and **ead**, alongside updates to the Linux kernel, **OpenSSL**, **musl libc**, and **dropbear**. OpenWrt said several of the corrected issues could enable remote code execution, request smuggling, stored XSS, privilege escalation, arbitrary file read, memory corruption, or denial of service, and strongly urged users to upgrade. Advisory metadata for **CVE-2026-62948** indicates proof-of-concept exploitation exists, although exploitation is not considered automatable.
Jul 15, 2026
OpenWrt released **24.10.8** and corresponding **25.12.5** updates to fix a critical remote code execution flaw in `odhcpd`, tracked as **CVE-2026-53921**, that could let an unauthenticated attacker send a crafted DHCPv6 `REQUEST` to UDP port `547` and potentially execute code as **root** on affected routers. The project said the service release addresses numerous security issues, including several **remotely triggerable flaws in default-enabled network services**, and strongly recommended that users upgrade. OpenWrt also updated its 24.10 stable release pages to identify **24.10.8** as the latest release in the series. Beyond the DHCPv6 bug, the release includes fixes across the **Linux kernel**, `dnsmasq`, `uhttpd`, `rpcd`, `cgi-io`, LuCI components, `umdns`, `ead`, `hostapd`/`wpa_supplicant`, `dropbear`, `musl libc`, and **OpenSSL**. Reported issues addressed include three HTTP request-smuggling bugs in `uhttpd`, a DHCPv6 hostname-injection flaw leading to stored XSS in LuCI, and a path traversal issue in `cgi-io` tracked as **CVE-2026-62947**; OpenWrt noted that optional package fixes require separate package updates. The project also said the **24.10** branch is now in **security-maintenance mode** with end of life projected for September 2026, and advised users to migrate to **OpenWrt 25.12** before then.
Jul 29, 2026