Loading story…
Red Hat has released an Important security update for mrtg in Red Hat Enterprise Linux 10 to fix CVE-2026-72694, a local privilege-escalation flaw caused by improper link resolution, classified as CWE-59. The bug stems from symlink-following chown behavior in the MRTG daemon, allowing a low-privileged local user to manipulate the PID file path and potentially gain unauthorized control over file ownership, with resulting confidentiality and integrity impact but no reported availability impact.
Equivalent advisories and detection coverage have also appeared across downstream enterprise Linux distributions, including Rocky Linux 10, Oracle Linux 10, and AlmaLinux 10, indicating broad package exposure in Linux 10-based environments. Red Hat shipped fixed packages in version mrtg-2.17.10-12.el10_2.1 for multiple architectures, while Tenable plugins for the related vendor notices report the issue as locally exploitable with low privileges required and state that no known exploits are currently available.
Get the actors, campaigns, and ATT&CK mapping behind it.
6 events from the most recent confirmed update back to the earliest known activity.
A Rocky Linux security notice for Rocky Linux 10 reported that a patch for CVE-2026-72694 was published. The notice covers MRTG-related packages and states no known exploits are available.
AlmaLinux issued advisory ALSA-2026-57596 for AlmaLinux 10 and multiple repository variants, covering mrtg and mrtg-selinux packages affected by CVE-2026-72694. The advisory classifies the issue as CWE-59 and states no known exploits are available.
Oracle Linux published security advisory ELSA-2026-57600 for the mrtg package on Oracle Linux 9, addressing CVE-2026-72694. The advisory describes the flaw as locally exploitable and notes that no known exploits are available.
Oracle Linux published security notice ELSA-2026-57596 for mrtg and mrtg-selinux on Oracle Linux 10, addressing CVE-2026-72694. The notice describes the flaw as locally exploitable with low privileges and high confidentiality and integrity impact.
Red Hat published RHSA-2026:57596 for Red Hat Enterprise Linux 10, providing updated mrtg packages version 2.17.10-12.el10_2.1. The advisory says the update fixes CVE-2026-72694, a symlink-following chown issue in the MRTG daemon that can allow local privilege escalation via PID file path manipulation.
The vulnerability CVE-2026-72694 was published as a locally exploitable MRTG flaw associated with symlink-following behavior and privilege escalation risk. Multiple downstream Linux security notices reference this publication date.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
6 references tracked. Mallory keeps watching after this page renders.
tenable.com
Open sourcetenable.com
Open sourcetenable.com
Open sourcetenable.com
Open sourceaccess.redhat.com
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat disclosed **CVE-2026-50526**, a moderate-severity flaw in **.NET** caused by improper link resolution before file access, tracked as **`CWE-59`**. The vulnerability allows an authorized local attacker to exploit link following behavior to tamper with files, potentially modifying application data or system files outside the intended target. Red Hat assigned the issue a **CVSS v3 score of 7.0**, while the NVD scored it **5.5**, reflecting different assessments of the flaw's impact. The weakness matches the broader **link following** class in which software accesses a file path without preventing resolution through symlinks, hard links, shortcuts, or similar mechanisms, creating opportunities for unauthorized read or write operations. Red Hat reported fixes across multiple **RHEL 8, 9, and 10** product lines, including specialized support channels such as **RHEL 10.0 EUS**, **RHEL 9.4 Update Services for SAP Solutions**, and **RHEL 9.6 EUS**, with remediation delivered through RHSA advisories published in July and August 2026.
Aug 24, 2026
A flaw in the Linux kernel's netfilter `xt_tcpmss` module, tracked as **`CVE-2026-43190`**, allows a remote attacker to trigger a one-byte out-of-bounds read with a specially crafted TCP packet. The bug is caused by improper validation of the remaining TCP option length before reading the option-length byte, and it can lead primarily to information disclosure with possible limited availability impact. The issue is not broadly reachable across all Linux systems; it affects hosts whose firewall rulesets use the `tcpmss` match. The Linux kernel CVE team published fixes across multiple stable branches, including **5.10.252**, **5.15.202**, **6.1.165**, **6.6.128**, **6.12.75**, **6.18.16**, **6.19.6**, and **7.0**, and advised users to move to the latest stable kernel releases. Red Hat later shipped the fix in **RHSA-2026:44694** for **Red Hat Enterprise Linux 10.0 Extended Update Support** kernel packages, alongside fixes for **`CVE-2026-31684`** and **`CVE-2026-46152`**; updated packages include kernel version **`6.12.0-55.92.1.el10_0`** for `x86_64`, `s390x`, `ppc64le`, and `aarch64`, and Red Hat said affected systems should be rebooted after installation.
Aug 25, 2026
`CVE-2026-31431` is a Linux kernel flaw classified as **CWE-669: Incorrect Resource Transfer Between Spheres** that can enable local privilege escalation to root and, in some cases, bypass isolation boundaries. The Canadian Centre for Cyber Security warned that the impact becomes more severe when the bug is chained with a remote code execution vulnerability, and urged organizations to identify exposed systems, apply vendor fixes, reboot after kernel updates, restrict access, enforce kernel security controls, monitor logs, and segment high-risk or Internet-facing workloads. Vendor and community activity indicates broad exposure across modern Linux platforms. Red Hat lists **RHEL 8**, **RHEL 9**, **RHEL 10**, and corresponding `kernel-rt` packages as affected, while **RHEL 6** and **RHEL 7** are marked not affected because the vulnerable code is absent. Public exploit interest accelerated after Theori published the **"Copy Fail"** technical write-up and proof-of-concept repository, which references testing on **Ubuntu 24.04 LTS**, **Amazon Linux 2023**, **RHEL 10.1**, and **SUSE 16**; Rocky Linux also published related errata, signaling downstream patch availability in enterprise Linux ecosystems.
Jun 29, 2026