Loading story…
NetworkManager fixed CVE-2026-19685, a flaw in 802.1X handling for private connection profiles that allowed users to set ca-path or phase2-ca-path as the sole trust root for EAP server certificate validation when no ca-cert was configured. In affected cases, the raw certificate authority directory path was passed to wpa_supplicant, which could still report the authentication server as verified even though the profile owner had effectively chosen the trust store. The fix rejects those CA directory properties for private connections unless they come from system-ca-certs, and instead requires use of ca-cert or system CA settings.
The issue was tied to earlier NetworkManager 1.56 work that changed private 802.1X connections to pass certificates and keys to wpa_supplicant as in-memory blobs rather than filesystem paths, a design intended to reduce TOCTOU risks and prevent abuse of permissive polkit settings. The new patch preserves directory-based CA paths for system-wide profiles, adds explicit configuration errors for invalid private-profile settings, and includes tests covering rejection of private-profile CA directories and behavior when system CA certificates are enabled. AWS has also published an advisory entry for CVE-2026-19685.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
A verified NetworkManager commit fixed CVE-2026-19685 by rejecting 802.1X ca-path and phase2-ca-path on private connections unless overridden by system CA certificates. The patch added explicit configuration errors, preserved CA-directory support for system-wide profiles, and introduced tests covering the unsafe private-profile cases and allowed overrides.
A NetworkManager 1.56 commit changed private 802.1X connections to pass certificates and keys to wpa_supplicant as in-memory blobs instead of filesystem paths, aiming to reduce TOCTOU risks and enforce access checks for the private profile owner. This commit is later identified as the origin of the vulnerable ca-path behavior for private connections.
NetworkManager merged the fix for CVE-2026-19685 into the main branch with commit fd83a13c after approval and a passing merge-request pipeline. The merge request states the change fixes the issue introduced by commit e85cc46d and closes issue #2001 while resolving Red Hat ticket RHEL-189084.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
explore.alas.aws.amazon.com
Open sourcegitlab.freedesktop.org
Open sourcegitlab.freedesktop.org
Open sourcegitlab.freedesktop.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco released security updates to address **CVE-2026-20245**, an authenticated local privilege escalation vulnerability in **Cisco Catalyst SD-WAN Manager**. The flaw stems from insufficient validation of user-supplied input during file upload, allowing a low-privileged local attacker to upload a crafted file, execute arbitrary commands, and escalate privileges to **root** on affected systems. The vulnerability carries a **CVSS score of 7.8** and requires low privileges, low attack complexity, and no user interaction. Security notices published in June urged organizations using affected SD-WAN Manager deployments to test and deploy Cisco's fixes as soon as possible to reduce the risk of post-authentication compromise of network management infrastructure.
Jul 8, 2026
Wireshark disclosed and fixed **CVE-2026-15166**, a stack-based buffer overflow in 802.11 EAPOL-Key decryption handling within `Dot11DecryptDecryptKeyData()`. The flaw stems from attacker-controlled EAPOL length fields reaching a `memcpy` into a fixed 1024-byte stack buffer without proper bounds checking on the decrypt path, allowing a malformed frame to corrupt the stack. The issue was reported in Wireshark's `tshark` processing and was reproduced with AddressSanitizer against commit `b260b00b861aef491d11043d2a8c9dd2615cdb9e` using the shipped `wpa-Induction.pcap` test capture. Wireshark said the vulnerability affects versions **4.6.0 through 4.6.6** and **4.4.0 through 4.4.16**, and could let an attacker crash the application by convincing a user to open a malformed packet trace file. The original report said that, when WPA decryption is enabled and a valid Security Association exists for the BSSID, a single crafted EAPOL-Key frame can overflow the buffer by roughly 1000 bytes, creating potential **RCE-class** impact in addition to denial of service. Wireshark released fixes in **4.6.7** and **4.4.17** and said it was not aware of active exploitation.
Aug 21, 2026
Cisco released security updates for multiple product lines, fixing 15 vulnerabilities across **Catalyst SD-WAN Software**, **IOS XE Software**, **IOS Software**, and **Integrated Management Controller**, with additional advisories covering **RoomOS**, **Secure Firewall Management Center**, and **Terminal Services Agent**. The most severe issues include several critical flaws in Catalyst SD-WAN, including `CVE-2026-20303` through `CVE-2026-20313`, and critical vulnerabilities in IOS XE that could allow **authentication bypass**, **command injection**, **privilege escalation**, and unauthorized access to restricted functions on enterprise routers, switches, and WAN infrastructure. Cisco said the vulnerabilities could enable attackers to disrupt WAN environments, execute commands, and in some cases compromise broader network environments, while a separate high-severity issue in Integrated Management Controller could lead to root compromise and Secure Firewall Management Center was found to contain a static-credential weakness. Cisco published patched software versions and, according to reporting and CERT guidance, organizations were urged to review the advisories and deploy the August security updates promptly; Cisco said it had no indication of active exploitation at the time of disclosure.
Aug 11, 2026