A flaw was found in NetworkManager. This local privilege escalation vulnerability exists in NetworkManager's dhclient backend when processing malformed Manufacturer Usage Description (MUD) URLs. A local user can exploit this flaw to escalate privileges by triggering a script via a crafted MUD URL, provided an administrator has explicitly configured NetworkManager to use dhclient. This issue does not affect default configurations of NetworkManager.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:58572 advisory.

    * NetworkManager: NetworkManager: Local privilege escalation via malformed MUD URLs in dhclient backend     (CVE-2026-10805)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:58555 advisory.

    * NetworkManager: NetworkManager: Local privilege escalation via malformed MUD URLs in dhclient backend     (CVE-2026-10805)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-58555 advisory.

    [1.40.16-21.0.1]
    - Add support for DAD_CONFLICT to nm-dispatcher
    - Drop 777 permissions from Networkmanager-dispatcher drop-in directory [Orabug: 37581862]
    - Add a dropin file to make Networkmanager-dispatcher persistent [Orabug: 36989910]
    - disable MPTCP handling by default [Orabug: 35081472]
    - Fix ignore-carrier logic [Orabug: 34956744]
    - Disable regeneration of the documentation [Orabug: 34712048]
    - add connectivity check via Oracle servers [Orabug: 32051972]
    - Disable the build of NetworkManager-config-connectivity-* subpackage for 8.3
    - Revert 'infiniband: avoid normalizing the p-key when reading from ifcfg'

    [1:1.40.16-21]
    - Fix CVE-2026-10805 (RHEL-191622)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-58572 advisory.

    [1.54.3-5.0.1]
    - Introduce always-ignore-carrier setting [Orabug: 39663315]
    - disable MPTCP handling by default [Orabug: 34801142]
    - add connectivity check via Oracle servers [Orabug: 32051972]
    - Add a dropin file to make Networkmanager-dispatcher persistent [Orabug: 36989910]
    - Drop 777 permissions from the NetworkManager-dispatcher drop-in directory [Orabug: 37581907]

    [1:1.54.3-5]
    - Fix CVE-2026-10805 (RHEL-191624)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:58572 advisory.

    * NetworkManager: NetworkManager: Local privilege escalation via malformed MUD URLs in dhclient backend     (CVE-2026-10805)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:58555 advisory.

    * NetworkManager: NetworkManager: Local privilege escalation via malformed MUD URLs in dhclient backend     (CVE-2026-10805)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:58572 advisory.

    NetworkManager is a system network service that manages network devices and connections, attempting to     keep active network connectivity when available. Its capabilities include managing Ethernet, wireless,     mobile broadband (WWAN), and PPPoE devices, as well as providing VPN integration with a variety of     different VPN services.

    Security Fix(es):

    * NetworkManager: NetworkManager: Local privilege escalation via malformed MUD URLs in dhclient backend     (CVE-2026-10805)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:58555 advisory.

    NetworkManager is a system network service that manages network devices and connections, attempting to     keep active network connectivity when available. Its capabilities include managing Ethernet, wireless,     mobile broadband (WWAN), and PPPoE devices, as well as providing VPN integration with a variety of     different VPN services.

    Security Fix(es):

    * NetworkManager: NetworkManager: Local privilege escalation via malformed MUD URLs in dhclient backend     (CVE-2026-10805)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099514 advisory.

    A flaw was found in NetworkManager. This local privilege escalation vulnerability exists in     NetworkManager's dhclient backend when processing malformed Manufacturer Usage Description (MUD) URLs. A     local user can exploit this flaw to escalate privileges by triggering a script via a crafted MUD URL,     provided an administrator has explicitly configured NetworkManager to use dhclient. This issue does not     affect default configurations of NetworkManager.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the NetworkManager-1.54.4-2.el9 build changelog.

  - A flaw was found in NetworkManager. This local privilege escalation vulnerability exists in     NetworkManager's dhclient backend when processing malformed Manufacturer Usage Description (MUD) URLs. A     local user can exploit this flaw to escalate privileges by triggering a script via a crafted MUD URL,     provided an administrator has explicitly configured NetworkManager to use dhclient. This issue does not     affect default configurations of NetworkManager. (CVE-2026-10805)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in NetworkManager. This local privilege escalation vulnerability exists in     NetworkManager's dhclient backend when processing malformed Manufacturer Usage Description (MUD) URLs. A     local user can exploit this flaw to escalate privileges by triggering a script via a crafted MUD URL,     provided an administrator has explicitly configured NetworkManager to use dhclient. This issue does not     affect default configurations of NetworkManager. (CVE-2026-10805)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
339398	AlmaLinux 9 : NetworkManager (ALSA-2026:58572)	Nessus	Alma Linux Local Security Checks	Local	medium
339382	AlmaLinux 8 : NetworkManager (ALSA-2026:58555)	Nessus	Alma Linux Local Security Checks	Local	medium
339358	Oracle Linux 8 : NetworkManager (ELSA-2026-58555)	Nessus	Oracle Linux Local Security Checks	Local	medium
339148	Oracle Linux 9 : NetworkManager (ELSA-2026-58572)	Nessus	Oracle Linux Local Security Checks	Local	medium
339145	RockyLinux 9 : NetworkManager (RLSA-2026:58572)	Nessus	Rocky Linux Local Security Checks	Local	medium
339144	RockyLinux 8 : NetworkManager (RLSA-2026:58555)	Nessus	Rocky Linux Local Security Checks	Local	medium
339088	RHEL 9 : NetworkManager (RHSA-2026:58572)	Nessus	Red Hat Local Security Checks	Local	medium
339078	RHEL 8 : NetworkManager (RHSA-2026:58555)	Nessus	Red Hat Local Security Checks	Local	medium
336722	Unity Linux 20.1070e Security Update: NetworkManager (UTSA-2026-099514)	Nessus	Unity Linux Local Security Checks	Local	medium
325273	CentOS 9 : NetworkManager-1.54.4-2.el9	Nessus	CentOS Local Security Checks	Local	medium
318593	Linux Distros Unpatched Vulnerability : CVE-2026-10805	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-10805

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium