acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1529:02 advisory.

    * acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369)
      * acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the acl package has been released.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0804 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2026-54369:
    acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions     acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers     to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any     component of a pathname processed by a privileged caller can redirect ACL read or write operations to     arbitrary files or directories, enabling unauthorized manipulation of access control lists and local     privilege escalation.

    CVE-2026-54370:
    acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability     that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link     between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(),     acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access     control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged     process over an attacker-controlled path, resulting in local privilege escalation.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of acl installed on the remote host is prior to 2.2.51-14. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3831 advisory.

    A flaw was found in the `acl` component, specifically within its `libacl` pathname-based functions. A     local attacker could exploit this vulnerability by using a symbolic link to replace a pathname component.
    This could allow the attacker to redirect access control list (ACL) read or write operations to arbitrary     files or directories, leading to unauthorized manipulation of ACLs and ultimately local privilege     escalation. (CVE-2026-54369)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1434:01 advisory.

    * acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369)
      * acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-43420 advisory.

    [2.4.0-1]
    - rebase to 2.4.0 to fix the following CVEs:
      - CVE-2026-54369 - Symlink traversal privilege escalation via libacl functions (RHEL-186111)
      - CVE-2026-54370 - TOCTOU Symlink Traversal via getfacl/setfacl (RHEL-186216)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:43420 advisory.

    * acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369)

    * acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:42739 advisory.

    * acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369)

    * acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:42736 advisory.

    * acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369)

    * acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:42739 advisory.

    * acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369)
      * acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:43420 advisory.

    * acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369)
      * acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:42736 advisory.

    * acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369)
      * acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:43420 advisory.

    Access Control Lists (ACLs) are used to define fine-grained discretionary access rights for files and     directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access     control lists.

    Security Fix(es):

    * acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369)

    * acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-42739 advisory.

    [2.4.0-1]
    - rebase to 2.4.0 to fix the following CVEs:
      - CVE-2026-54369 - Symlink traversal privilege escalation via libacl functions (RHEL-186106)
      - CVE-2026-54370 - TOCTOU Symlink Traversal via getfacl/setfacl (RHEL-186207)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-42736 advisory.

    [2.4.0-1]
    - rebase to 2.4.0 to fix the following CVEs:
      - CVE-2026-54369 - Symlink traversal privilege escalation via libacl functions (RHEL-186111)
      - CVE-2026-54370 - TOCTOU Symlink Traversal via getfacl/setfacl (RHEL-186216)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:42736 advisory.

    Access Control Lists (ACLs) are used to define fine-grained discretionary access rights for files and     directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access     control lists.

    Security Fix(es):

    * acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369)

    * acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:42739 advisory.

    Access Control Lists (ACLs) are used to define fine-grained discretionary access rights for files and     directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access     control lists.

    Security Fix(es):

    * acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369)

    * acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1986 advisory.

    A flaw was found in the `acl` component, specifically within its `libacl` pathname-based functions. A     local attacker could exploit this vulnerability by using a symbolic link to replace a pathname component.
    This could allow the attacker to redirect access control list (ACL) read or write operations to arbitrary     files or directories, leading to unauthorized manipulation of ACLs and ultimately local privilege     escalation. (CVE-2026-54369)

    A time-of-check to time-of-use (TOCTOU) race condition vulnerability was found in acl. By replacing a     pathname component with a symbolic link between a security check and subsequent file operations, an     attacker can redirect file access control list operations. This occurs when privileged processes invoke     `getfacl` or `setfacl` over an attacker-controlled path, potentially leading to local privilege     escalation. (CVE-2026-54370)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-67504c329b advisory.

    * rebase to v2.4.0 to fix CVE-2026-54369 and CVE-2026-54370

    Resolves: CVE-2026-54369     Resolves: CVE-2026-54370

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6b9a652463 advisory.

    * rebase to v2.4.0 to fix CVE-2026-54369 and CVE-2026-54370

    Resolves: CVE-2026-54369     Resolves: CVE-2026-54370

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions     acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers     to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any     component of a pathname processed by a privileged caller can redirect ACL read or write operations to     arbitrary files or directories, enabling unauthorized manipulation of access control lists and local     privilege escalation. (CVE-2026-54369)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
335193	MiracleLinux 9 : acl-2.4.0-1.el9_8 (AXSA:2026-1529:02)	Nessus	Miracle Linux Local Security Checks	Local	high
333262	Photon OS 5.0: Acl PHSA-2026-5.0-92-0946	Nessus	PhotonOS Local Security Checks	Local	high
333151	TencentOS Server 3: acl (TSSA-2026:0804)	Nessus	Tencent Local Security Checks	Local	high
332055	Amazon Linux 2 : acl, --advisory ALAS2-2026-3831 (ALAS-2026-3831)	Nessus	Amazon Linux Local Security Checks	Local	high
331864	MiracleLinux 8 : acl-2.4.0-1.el8 (AXSA:2026-1434:01)	Nessus	Miracle Linux Local Security Checks	Local	high
329257	Oracle Linux 8 : acl (ELSA-2026-43420)	Nessus	Oracle Linux Local Security Checks	Local	high
329188	RockyLinux 8 : acl (RLSA-2026:43420)	Nessus	Rocky Linux Local Security Checks	Local	high
329053	RockyLinux 10 : acl (RLSA-2026:42739)	Nessus	Rocky Linux Local Security Checks	Local	high
329050	RockyLinux 9 : acl (RLSA-2026:42736)	Nessus	Rocky Linux Local Security Checks	Local	high
328985	AlmaLinux 10 : acl (ALSA-2026:42739)	Nessus	Alma Linux Local Security Checks	Local	high
328984	AlmaLinux 8 : acl (ALSA-2026:43420)	Nessus	Alma Linux Local Security Checks	Local	high
328971	AlmaLinux 9 : acl (ALSA-2026:42736)	Nessus	Alma Linux Local Security Checks	Local	high
328948	RHEL 8 : acl (RHSA-2026:43420)	Nessus	Red Hat Local Security Checks	Local	high
328892	Oracle Linux 10 : acl (ELSA-2026-42739)	Nessus	Oracle Linux Local Security Checks	Local	high
328858	Oracle Linux 9 : acl (ELSA-2026-42736)	Nessus	Oracle Linux Local Security Checks	Local	high
328857	RHEL 9 : acl (RHSA-2026:42736)	Nessus	Red Hat Local Security Checks	Local	high
328802	RHEL 10 : acl (RHSA-2026:42739)	Nessus	Red Hat Local Security Checks	Local	high
328504	Amazon Linux 2023 : acl, libacl, libacl-devel (ALAS2023-2026-1986)	Nessus	Amazon Linux Local Security Checks	Local	high
326431	Fedora 43 : acl (2026-67504c329b)	Nessus	Fedora Local Security Checks	Local	high
326364	Fedora 44 : acl (2026-6b9a652463)	Nessus	Fedora Local Security Checks	Local	high
323731	Linux Distros Unpatched Vulnerability : CVE-2026-54369	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-54369

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high