Loading story…
A critical vulnerability tracked as CVE-2026-32746 was disclosed in GNU InetUtils telnetd affecting version 2.7 and earlier, enabling pre-authentication remote code execution through a buffer overflow in the LINEMODE SLC handler. The flaw stems from a missing bounds check in the add_slc function, which can trigger an out-of-bounds memory write during the Telnet handshake before the login prompt is shown. Security reporting said a remote unauthenticated attacker could exploit the bug to execute code as root, resulting in full system compromise.
The issue was rated CVSS 9.8 and public proof-of-concept exploit code was reported as available, increasing the likelihood of exploitation against exposed Telnet services. Advisories urged organizations to treat internet-accessible telnetd instances as high risk and apply mitigations until patches are available, including restricting access to trusted IP addresses, blocking TCP port 23, or disabling Telnet entirely where it is not operationally required.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
CSIRT.SK reported that CVE-2026-32746 affects GNU InetUtils telnetd 2.7 and earlier, can be exploited during the telnet handshake before login, and may allow remote code execution as root. The report also stated that proof-of-concept exploit code was publicly available and recommended mitigations until patches are released.
Dream Security published an advisory for CVE-2026-32746, a pre-authentication remote code execution flaw in GNU InetUtils telnetd caused by a buffer overflow in the LINEMODE SLC handler.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourcedreamgroup.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed **CVE-2026-32746**, a critical `telnetd` vulnerability in **GNU Inetutils** that allows an unauthenticated remote attacker to achieve **root remote code execution** by exploiting a buffer overflow in the **LINEMODE SLC (Set Local Characters)** option handler. The flaw affects GNU Inetutils `telnetd` through version `2.7`, carries a **CVSS 9.8**, and can be triggered during the initial Telnet handshake on **port 23** before any login prompt appears, requiring no credentials, no user interaction, and no special network position. The issue was discovered and reported by **Dream** on March 11, 2026, and GNU maintainers reportedly confirmed the finding, with a fix expected by **April 1, 2026**. Both reports warn that successful exploitation can lead to full system compromise because `telnetd` often runs with elevated privileges, enabling follow-on activity such as persistent backdoors, data theft, and lateral movement. The risk is especially acute in **legacy environments** where Telnet remains in use, including **ICS/OT, PLC, SCADA, and some government systems**, even though public reporting has not yet indicated active exploitation in the wild.
Jul 1, 2026
GNU InetUtils disclosed **CVE-2026-24061**, a high-severity authentication bypass in `telnetd` that can let a remote client obtain **root** access without valid credentials. The bug affects versions **1.9.3 through 2.7** and stems from `telnetd` passing a client-controlled `USER` environment variable to `/usr/bin/login` without sanitization; a crafted value such as `-f root` can cause `login(1)` to skip normal authentication. The vulnerable code path was traced to a 2015 commit later shipped in the 1.9.3 release, and maintainers published patches while advising organizations not to run `telnetd`, to restrict access to trusted clients, and to upgrade to a fixed release. Public attention quickly expanded beyond the advisory as security researchers and developers published multiple **proof-of-concept exploits, scanners, Nuclei templates, test harnesses, and detection content** on GitHub and in vendor repositories. Those references describe tooling for discovery and exploitation of the `NEW_ENVIRON`/`USER` injection path, including lab environments and root-shell demonstrations, increasing the likelihood of opportunistic targeting against exposed Telnet services. The combination of a remotely reachable root bypass and rapidly available offensive tooling makes internet-facing or internally exposed GNU InetUtils `telnetd` instances an urgent remediation priority.
Jun 29, 2026
GNU InetUtils disclosed a high-severity authentication bypass in `telnetd`, tracked as **CVE-2026-24061**, that allows a remote attacker to obtain a root shell by abusing how the daemon invokes `/usr/bin/login`. In affected versions **1.9.3 through 2.7**, `telnetd` passes the client-controlled `USER` environment variable without proper sanitization, enabling an attacker to supply values such as `-f root` and trigger login’s authentication-bypass behavior. The flaw was reportedly introduced by a 2015 code change, remained present for more than a decade, and carries a **CVSS 9.8** severity rating. GNU InetUtils published patches to sanitize variable expansions used in the login invocation, including a broader hardening change after the initial fix, and advised administrators to upgrade or apply the available patches immediately. Where patching is not possible, maintainers and CSIRT.SK recommended disabling `telnetd`, restricting Telnet access to trusted IP addresses, considering a `login(1)` implementation that rejects the `-f` flag, and reviewing logs for signs of compromise. CSIRT.SK also reported that **GreyNoise observed exploitation attempts in the wild**, increasing the urgency for exposed systems.
Jul 24, 2026