CVE-2026-91839

HighCVSS 7.8/10Last modified Sep 30, 2026

Description

A flaw was found in NetworkManager-fortisslvpn, the FortiSSLVPN plugin for NetworkManager. The nm-fortisslvpn-service improperly handles carriage-return/line-feed (CR/LF) characters in VPN connection profile credentials. A local unprivileged user can exploit this by crafting a malicious VPN profile to inject additional configuration directives. This can lead to arbitrary code execution with root privileges when the crafted VPN connection is activated.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-93

Affected software

Vendor	Product	Versions
GNOME	NetworkManager-fortisslvpn	< *

References

Timeline

Published: Sep 25, 2026
Last modified: Sep 30, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-91844.3The 24liveblog - live blog tool plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on CVE-2026-918407.8A flaw was found in NetworkManager-vpnc. This vulnerability allows a local unprivileged user to escalate privileges to root. By injecting a CVE-2026-918417.8A flaw was found in NetworkManager-vpnc, a VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by inject CVE-2026-918424.1A vulnerability has been found in OpenBankProject OBP-API up to 1.10.1. This impacts the function KryoInjection.invert of the file obp-api/s CVE-2026-918439.8A stack overflow during the unauthenticated login process may allow an attacker to run arbitrary code remotely with root privileges.CVE-2026-918447.3Unrestricted upload of file with dangerous type vulnerability in İzometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip allows Us CVE-2026-918467.1Affected versions of MISP allow a collection element to be created from a bare UUID without consistently checking whether the acting user is CVE-2026-918474.8The Online Scheduling and Appointment Booking System WordPress plugin before 28.2 does not verify that the requester owns the AI booking-as CVE-2026-918487.3A vulnerability was identified in WuzhiCMS up to 4.1.0. Affected by this issue is the function article::getDataOfJson of the file /index.php CVE-2026-918496.3A security flaw has been discovered in WuzhiCMS up to 4.1.0. This affects the function member::setAvatar of the file /index.php?m=member&f=u CVE-2026-91857.5The 6Storage Rentals plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and includ CVE-2026-918515.3Affected versions of MISP incorrectly filter dashboard templates that are restricted to a specific permission flag. DashboardsController::