CVE-2026-25702

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A Improper Access Control vulnerability in the kernel of SUSE SUSE Linux Enterprise Server 12 SP5 breaks nftables, causing firewall rules applied via nftables to not be effective.This issue affects SUSE Linux Enterprise Server: from 9e6d9d4601768c75fdb0bad3fbbe636e748939c2 before 9c294edb7085fb91650bc12233495a8974c5ff2d.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Mar 5, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-257037.3NeuVector through 5.4.9 is can potentially leak information from manager /network/graph API due to missing authentication and cached data co CVE-2026-257045.8A Privilege Dropping / Lowering Errors/Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in cosmic-greeter can allow an attac CVE-2026-257058.4A vulnerability has been identified in [Rancher's Extensions](https://ranchermanager.docs.rancher.com/integrations-in-rancher/rancher-extens CVE-2026-257067.5Improper neutralization of special elements used in an OS command in yast2-samba-client allows an attacker who controls the content of an Ac CVE-2026-257078.8A relative path traversal bug problem when processing repository metadata in libzypp before 17.38.10 could be used by remote attackers suppl CVE-2026-25714.3The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'reviewUserS CVE-2026-257107.0The new upstream added a privileged D-Bus helper called plasmaloginauthhelper, which suffers from multiple issues, e.g.aA compromised plasma CVE-2026-257117.5The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the CVE-2026-257127.5Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private organization CVE-2026-257137.8A heap-based buffer overflow vulnerability exists in the ID3v2 parsing functionality of MediaInfoLib (version(s): 26.01). A specially crafte CVE-2026-257144.3Gitea versions up to and including 1.26.1 do not apply public-only token filtering consistently to the user organization API, leaving an inc CVE-2026-257159.8The web management interface of the device allows the administrator username and password to be set to blank values. Once applied, the dev