A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a symbolic link (symlink) following vulnerability. By influencing or pre-placing a symlink in the process ID (PID) file path, the attacker can trick the root process into changing the ownership of an arbitrary existing file to the daemon user. This can lead to local privilege escalation, allowing unauthorized access to or modification of sensitive files.

The version of mrtg installed on the remote host is prior to 2.17.4-11. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3884 advisory.

    A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops     privileges, a local, low-privileged attacker can exploit a symbolic link (symlink) following     vulnerability. By influencing or pre-placing a symlink in the process ID (PID) file path, the attacker can     trick the root process into changing the ownership of an arbitrary existing file to the daemon user. This     can lead to local privilege escalation, allowing unauthorized access to or modification of sensitive     files. (CVE-2026-72694)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1680:02 advisory.

    * mrtg: MRTG daemon symlink-following chown allows local privilege escalation via PID file path     manipulation (CVE-2026-72694)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:57600 advisory.

    * mrtg: MRTG daemon symlink-following chown allows local privilege escalation via PID file path     manipulation (CVE-2026-72694)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-57600 advisory.

    [2.17.7-12.0.1.el9_8.1]
    - Create mrtg lock file before running restorecon on it [Orabug: 39096845]

    [2.17.7-12.1]
    - Fix CVE-2026-72694: symlink-following chown of pid file in daemon mode       Resolves: RHEL-236047

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:57596 advisory.

    * mrtg: MRTG daemon symlink-following chown allows local privilege escalation via PID file path     manipulation (CVE-2026-72694)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-57596 advisory.

    [2.17.10-12.1]
    - Fix symlink-following chown of pid file in daemon mode (CVE-2026-72694)       Resolves: RHEL-236045

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:57596 advisory.

    * mrtg: MRTG daemon symlink-following chown allows local privilege escalation via PID file path     manipulation (CVE-2026-72694)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:57600 advisory.

    * mrtg: MRTG daemon symlink-following chown allows local privilege escalation via PID file path     manipulation (CVE-2026-72694)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:57596 advisory.

    The Multi Router Traffic Grapher (MRTG) monitors the traffic load on network connections. MRTG generates     HTML pages containing PNG images which provide a live visual representation of this traffic.

    Security Fix(es):

    * mrtg: MRTG daemon symlink-following chown allows local privilege escalation via PID file path     manipulation (CVE-2026-72694)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:57600 advisory.

    The Multi Router Traffic Grapher (MRTG) monitors the traffic load on network connections. MRTG generates     HTML pages containing PNG images which provide a live visual representation of this traffic.

    Security Fix(es):

    * mrtg: MRTG daemon symlink-following chown allows local privilege escalation via PID file path     manipulation (CVE-2026-72694)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0844 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-72694:
    A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops     privileges, a local, low-privileged attacker can exploit a symbolic link (symlink) following     vulnerability. By influencing or pre-placing a symlink in the process ID (PID) file path, the attacker can     trick the root process into changing the ownership of an arbitrary existing file to the daemon user. This     can lead to local privilege escalation, allowing unauthorized access to or modification of sensitive     files.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops     privileges, a local, low-privileged attacker can exploit a symbolic link (symlink) following     vulnerability. By influencing or pre-placing a symlink in the process ID (PID) file path, the attacker can     trick the root process into changing the ownership of an arbitrary existing file to the daemon user. This     can lead to local privilege escalation, allowing unauthorized access to or modification of sensitive     files. (CVE-2026-72694)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
341849	Amazon Linux 2 : mrtg, --advisory ALAS2-2026-3884 (ALAS-2026-3884)	Nessus	Amazon Linux Local Security Checks	Local	high
341074	MiracleLinux 9 : mrtg-2.17.7-12.el9_8.1 (AXSA:2026-1680:02)	Nessus	Miracle Linux Local Security Checks	Local	high
339392	AlmaLinux 9 : mrtg (ALSA-2026:57600)	Nessus	Alma Linux Local Security Checks	Local	high
339141	Oracle Linux 9 : mrtg (ELSA-2026-57600)	Nessus	Oracle Linux Local Security Checks	Local	high
339126	AlmaLinux 10 : mrtg (ALSA-2026:57596)	Nessus	Alma Linux Local Security Checks	Local	high
339118	Oracle Linux 10 : mrtg (ELSA-2026-57596)	Nessus	Oracle Linux Local Security Checks	Local	high
338773	RockyLinux 10 : mrtg (RLSA-2026:57596)	Nessus	Rocky Linux Local Security Checks	Local	high
338680	RockyLinux 9 : mrtg (RLSA-2026:57600)	Nessus	Rocky Linux Local Security Checks	Local	high
338426	RHEL 10 : mrtg (RHSA-2026:57596)	Nessus	Red Hat Local Security Checks	Local	high
338419	RHEL 9 : mrtg (RHSA-2026:57600)	Nessus	Red Hat Local Security Checks	Local	high
337138	TencentOS Server 4: mrtg (TSSA-2026:0844)	Nessus	Tencent Local Security Checks	Local	high
334497	Linux Distros Unpatched Vulnerability : CVE-2026-72694	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-72694

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high