CVE-2026-91839

EUVD-2026-87249

25.09.2026, 18:17

A flaw was found in NetworkManager-fortisslvpn, the FortiSSLVPN plugin for NetworkManager. The nm-fortisslvpn-service improperly handles carriage-return/line-feed (CR/LF) characters in VPN connection profile credentials. A local unprivileged user can exploit this by crafting a malicious VPN profile to inject additional configuration directives. This can lead to arbitrary code execution with root privileges when the crafted VPN connection is activated.

CRLF Injection

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.8 HIGH	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Debian Releases

Debian Product

Codename

network-manager-fortisslvpn

bookworm

vulnerable

Ubuntu Releases

Ubuntu Product

Codename

network-manager-fortisslvpn

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
resolute	dne

Common Weakness Enumeration

CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
The software uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

References

https://access.redhat.com/security/cve/CVE-2026-91839

https://bugzilla.redhat.com/show_bug.cgi?id=2533640

https://gitlab.gnome.org/Archive/NetworkManager-fortisslvpn/-/work_items/80

https://gitlab.gnome.org/Archive/NetworkManager-fortisslvpn/-/work_items/80