A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system.

According to the versions of the systemd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A flaw was found in systemd. The systemd-machined service contains an Improper Access Control     vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop     Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a     specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the     attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with     root privileges on the host system.(CVE-2026-4105)

    systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an     unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an     assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is     not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions     older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known     workarounds are available.(CVE-2026-29111)

    In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional     config file.(CVE-2026-40226)

Tenable has extracted the preceding description block directly from the EulerOS systemd security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the systemd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional     config file.(CVE-2026-40226)

    A flaw was found in systemd. The systemd-machined service contains an Improper Access Control     vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop     Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a     specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the     attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with     root privileges on the host system.(CVE-2026-4105)

    systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an     unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an     assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is     not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions     older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known     workarounds are available.(CVE-2026-29111)

Tenable has extracted the preceding description block directly from the EulerOS systemd security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the systemd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional     config file.(CVE-2026-40226)

    A flaw was found in systemd. The systemd-machined service contains an Improper Access Control     vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop     Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a     specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the     attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with     root privileges on the host system.(CVE-2026-4105)

    systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an     unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an     assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is     not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions     older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known     workarounds are available.(CVE-2026-29111)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization systemd security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the systemd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an     unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an     assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is     not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions     older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known     workarounds are available.(CVE-2026-29111)

    A flaw was found in systemd. The systemd-machined service contains an Improper Access Control     vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop     Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a     specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the     attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with     root privileges on the host system.(CVE-2026-4105)

Tenable has extracted the preceding description block directly from the EulerOS systemd security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4533 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4533-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                     Arnaud Rebillout     April 15, 2026                                https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : systemd     Version        : 247.3-7+deb11u8     CVE ID         : CVE-2026-4105 CVE-2026-29111 CVE-2026-40225 CVE-2026-40226     Debian Bug     :

    The following vulnerabilities have been discovered systemd:

    CVE-2026-4105

        The systemd-machined service contains an Improper Access Control         vulnerability due to insufficient validation of the class parameter in         the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged         user can exploit this by attempting to register a machine with a         specific class value, which may leave behind a usable,         attacker-controlled machine object. This allows the attacker to invoke         methods on the privileged object, leading to the execution of         arbitrary commands with root privileges on the host system.

    CVE-2026-29111

        When an unprivileged IPC API call is made with spurious data, a stack         overwrite occurs, with the attacker controlled content.

    CVE-2026-40225

        udev: local root execution can occur via malicious hardware devices         and unsanitized kernel output.

    CVE-2026-40226

        nspawn: an escape-to-host action can occur via a crafted optional         config file.

    For Debian 11 bullseye, these problems have been fixed in version     247.3-7+deb11u8.

    We recommend that you upgrade your systemd packages.

    For the detailed security status of systemd please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/systemd

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20471-1 advisory.

    Update to systemd v257.13:

    Security issues:

    - CVE-2026-4105: privilege escalation due to improper access control in RegisterMachine D-Bus method     (bsc#1259650).
    - CVE-2026-29111: local unprivileged user can trigger an assert in systemd (bsc#1259418).
    - udev: local root execution via malicious hardware devices and unsanitized kernel output (bsc#1259697).

    Non security issues:

    - Avoid shipping (empty) directories and ghost files in /var (jsc#PED-14853).
    - Sign systemd-boot EFI binary on aarch64 (bsc#1258344)
    - terminal-util: stop doing 0/upper bound check in tty_is_vc() (bsc#1255326)

    Changelog:

    - 6941d92dc2 machined: reject invalid class types when registering machines (bsc#1259650 CVE-2026-4105)
    - 03bb697b8d udev: check for invalid chars in various fields received from the kernel (bsc#1259697)
    - 54588d2ded core: validate input cgroup path more prudently (bsc#1259418 CVE-2026-29111)
    - fb9d92682b terminal-util: stop doing 0/upper bound check in tty_is_vc() (bsc#1255326)

    For a complete list of changes, visit:
     https://github.com/openSUSE/systemd/compare/3c53ef3ea20bd43ef587cbdfa7107aeb1ef55654...d349fc5cd4f9ee2b78     84c2610647e92806d14b28

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1061-1 advisory.

    - CVE-2026-4105: privilege escalation due to improper access control in RegisterMachine D-Bus method     (bsc#1259650).
    - CVE-2026-29111: local unprivileged user can trigger an assert in systemd (bsc#1259418).
    - udev: check for invalid chars in various fields received from the kernel (bsc#1259697).

    Changelog:

    - 6a38d88a42 machined: reject invalid class types when registering machines
    - 8c9a592e5a udev: fix review mixup
    - b57007a917 udev-builtin-net-id: print cescaped bad attributes
    - ee23c7604b udev-builtin-net_id: do not assume the current interface name is ethX
    - 0f63e799e6 udev: ensure tag parsing stays within bounds
    - 046f52ec12 udev: ensure there is space for trailing NUL before calling sprintf
    - 5be21460ce udev: check for invalid chars in various fields received from the kernel
    - 9559607b16 core/cgroup: avoid one unnecessary strjoina()
    - fcae348ca4 core: validate input cgroup path more prudently
    - a3ca6b3031 alloc-util: add strdupa_safe() + strndupa_safe() and use it everywhere
    - 08125d6b06 units: add dep on systemd-logind.service by user@.service

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1040-1 advisory.

    - CVE-2026-4105: privilege escalation due to improper access control in RegisterMachine D-Bus method     (bsc#1259650).
    - CVE-2026-29111: local unprivileged user can trigger an assert in systemd (bsc#1259418).
    - udev: check for invalid chars in various fields received from the kernel (bsc#1259697).

    Changelog:

    - a943e3ce2f machined: reject invalid class types when registering machines
    - 71593f77db udev: fix review mixup
    - 73a89810b4 udev-builtin-net-id: print cescaped bad attributes
    - 0f360bfdc0 udev-builtin-net_id: do not assume the current interface name is ethX
    - 40905232e2 udev: ensure tag parsing stays within bounds
    - 7bce9026e3 udev: ensure there is space for trailing NUL before calling sprintf
    - d018ac1ea3 udev: check for invalid chars in various fields received from the kernel
    - aef6e11921 core/cgroup: avoid one unnecessary strjoina()
    - cc7426f38a sd-json: fix off-by-one issue when updating parent for array elements
    - 26a748f727 core: validate input cgroup path more prudently
    - 99d8308fde core/dbus-manager: propagate meaningful dbus errors from EnqueueMarkedJobs

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:0991-1 advisory.

    This update for systemd fixes the following issue:

    - CVE-2026-4105: privilege escalation due to improper access control in RegisterMachine D-Bus method     (bsc#1259650).
    - udev: check for invalid chars in various fields received from the kernel (bsc#1259697).

    Changelog:

     cbf8ee66ee machined: reject invalid class types when registering machines      1a55ad48da udev: fix review mixup      1eba76668c udev-builtin-net-id: print cescaped bad attributes      cbd4b55380 udev: ensure tag parsing stays within bounds      5973d3b1cc udev: ensure there is space for trailing NUL before calling sprintf      f038eb6c8b udev: check for invalid chars in various fields received from the kernel

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-67f57405ee advisory.

    More bugfixes.

    ----

    - A bunch of bugfixes
    - More sanitization for invalid values received from hardware and firmware



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-0e8eeb6a8a advisory.

    - A bunch of bugfixes
    - More sanitization for invalid values received from hardware and firmware


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in systemd. The systemd-machined service contains an Improper Access Control     vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop     Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a     specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the     attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with     root privileges on the host system. (CVE-2026-4105)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
326199	EulerOS 2.0 SP12 : systemd (EulerOS-SA-2026-2632)	Nessus	Huawei Local Security Checks	medium
326168	EulerOS 2.0 SP12 : systemd (EulerOS-SA-2026-2572)	Nessus	Huawei Local Security Checks	medium
323202	EulerOS 2.0 SP15 : systemd (EulerOS-SA-2026-2469)	Nessus	Huawei Local Security Checks	medium
323144	EulerOS 2.0 SP15 : systemd (EulerOS-SA-2026-2510)	Nessus	Huawei Local Security Checks	medium
320741	EulerOS Virtualization 2.13.1 : systemd (EulerOS-SA-2026-2390)	Nessus	Huawei Local Security Checks	medium
320708	EulerOS Virtualization 2.13.0 : systemd (EulerOS-SA-2026-2419)	Nessus	Huawei Local Security Checks	medium
320292	EulerOS 2.0 SP13 : systemd (EulerOS-SA-2026-2315)	Nessus	Huawei Local Security Checks	medium
320271	EulerOS 2.0 SP13 : systemd (EulerOS-SA-2026-2358)	Nessus	Huawei Local Security Checks	medium
319959	EulerOS 2.0 SP11 : systemd (EulerOS-SA-2026-2229)	Nessus	Huawei Local Security Checks	medium
319955	EulerOS 2.0 SP11 : systemd (EulerOS-SA-2026-2266)	Nessus	Huawei Local Security Checks	medium
307620	Debian dla-4533 : libnss-myhostname - security update	Nessus	Debian Local Security Checks	medium
305859	openSUSE 16 Security Update : systemd (openSUSE-SU-2026:20471-1)	Nessus	SuSE Local Security Checks	medium
303956	SUSE SLES15 Security Update : systemd (SUSE-SU-2026:1061-1)	Nessus	SuSE Local Security Checks	medium
303939	SUSE SLED15: libsystemd0 / libsystemd0-32bit / libudev1 / libudev1-32bit / etc (SUSE-SU-2026:1040-1)	Nessus	SuSE Local Security Checks	medium
303575	SUSE SLES12 Security Update : systemd (SUSE-SU-2026:0991-1)	Nessus	SuSE Local Security Checks	medium
302827	Fedora 44 : systemd (2026-67f57405ee)	Nessus	Fedora Local Security Checks	medium
302334	Fedora 43 : systemd (2026-0e8eeb6a8a)	Nessus	Fedora Local Security Checks	medium
302156	Linux Distros Unpatched Vulnerability : CVE-2026-4105	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-4105

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium