A flaw was found in firewalld. A local unprivileged user can exploit this vulnerability by mis-authorizing two runtime D-Bus (Desktop Bus) setters, setZoneSettings2 and setPolicySettings. This mis-authorization allows the user to modify the runtime firewall state without proper authentication, leading to unauthorized changes in network security configurations.

According to the versions of the firewalld packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A flaw was found in firewalld. A local unprivileged user can exploit this vulnerability by mis-authorizing     two runtime D-Bus (Desktop Bus) setters, setZoneSettings2 and setPolicySettings. This mis-authorization     allows the user to modify the runtime firewall state without proper authentication, leading to     unauthorized changes in network security configurations.(CVE-2026-4948)

Tenable has extracted the preceding description block directly from the EulerOS firewalld security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1636 advisory.

    A flaw was found in firewalld. A local unprivileged user can exploit this vulnerability by mis-authorizing     two runtime D-Bus (Desktop Bus) setters, setZoneSettings2 and setPolicySettings. This mis-authorization     allows the user to modify the runtime firewall state without proper authentication, leading to     unauthorized changes in network security configurations. (CVE-2026-4948)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:1872-1 advisory.

    This update for firewalld fixes the following issue:

    - CVE-2026-4948: local unprivileged users can modify the runtime firewall state without proper     authentication due to       D-Bus setter mis-authorizations (bsc#1260903).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4585 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4585-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Andreas Henriksson     May 15, 2026                                  https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : firewalld     Version        : 0.9.3-2+deb11u1     CVE ID         : CVE-2026-4948     Debian Bug     :

    A flaw was found in firewalld where a local unprivileged user can     modify the runtime firewall state without proper authentication, leading to     unauthorized changes in network security configurations.

    For Debian 11 bullseye, this problem has been fixed in version     0.9.3-2+deb11u1.

    We recommend that you upgrade your firewalld packages.

    For the detailed security status of firewalld please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/firewalld

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in firewalld. A local unprivileged user can exploit this vulnerability by mis-authorizing     two runtime D-Bus (Desktop Bus) setters, setZoneSettings2 and setPolicySettings. This mis-authorization     allows the user to modify the runtime firewall state without proper authentication, leading to     unauthorized changes in network security configurations. (CVE-2026-4948)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
320263	EulerOS 2.0 SP13 : firewalld (EulerOS-SA-2026-2286)	Nessus	Huawei Local Security Checks	medium
320249	EulerOS 2.0 SP13 : firewalld (EulerOS-SA-2026-2329)	Nessus	Huawei Local Security Checks	medium
320000	EulerOS 2.0 SP11 : firewalld (EulerOS-SA-2026-2240)	Nessus	Huawei Local Security Checks	medium
319981	EulerOS 2.0 SP11 : firewalld (EulerOS-SA-2026-2202)	Nessus	Huawei Local Security Checks	medium
315621	Amazon Linux 2023 : firewalld, firewalld-filesystem, firewalld-test (ALAS2023-2026-1636)	Nessus	Amazon Linux Local Security Checks	medium
315054	SUSE SLED15 / SLES15 Security Update : firewalld (SUSE-SU-2026:1872-1)	Nessus	SuSE Local Security Checks	medium
314978	Debian dla-4585 : firewall-applet - security update	Nessus	Debian Local Security Checks	medium
303968	Linux Distros Unpatched Vulnerability : CVE-2026-4948	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-4948

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium