NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains a privilege escalation vulnerability that allows local users with permission to create VPN connections to execute arbitrary code as root by injecting pppd options through a crafted VPN username. Attackers can embed a double-quote character or whitespace in the username to break out of the pppd options file quoting context and include the pppd plugin directive, causing the privileged pppd process to load an attacker-controlled shared object.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4808 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4808-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                  Andreans Henriksson     October 01, 2026                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : network-manager-l2tp     Version        : 1.20.8-1+deb12u1     CVE ID         : CVE-2026-19624 CVE-2026-75131 CVE-2026-75883 CVE-2026-93337

    Andres Berbescu discovered two vulnerabilities in the L2TP connection     plugin for Network Manager which allowed a local user with permissions     to create/activate personal VPN connections to escalate their privileges     to root.

    For Debian 12 bookworm, these problems have been fixed in version     1.20.8-1+deb12u1.

    We recommend that you upgrade your network-manager-l2tp packages.

    For the detailed security status of network-manager-l2tp please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/network-manager-l2tp

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1b63888725 advisory.

    Updated to 1.52.6     Includes fixes for CVE-2026-75131 & CVE-2026-93337

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3a264a1bb3 advisory.

    Updated to 1.52.6     Includes fixes for CVE-2026-75131 & CVE-2026-93337

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6498 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6498-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     September 14, 2026                    https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : network-manager-l2tp     CVE ID         : CVE-2026-19624 CVE-2026-75131 CVE-2026-75883

    Andres Berbescu discovered two vulnerabilities in the L2TP connection     plugin for Network Manager which allowed a local user with permissions     to create/activate personal VPN connections to escalate their privileges     to root.

    For the stable distribution (trixie), these problems have been fixed in     version 1.20.20-2+deb13u1.

    We recommend that you upgrade your network-manager-l2tp packages.

    For the detailed security status of network-manager-l2tp please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/network-manager-l2tp

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains a privilege escalation vulnerability that     allows local users with permission to create VPN connections to execute arbitrary code as root by     injecting pppd options through a crafted VPN username. Attackers can embed a double-quote character or     whitespace in the username to break out of the pppd options file quoting context and include the pppd     plugin directive, causing the privileged pppd process to load an attacker-controlled shared object.
    (CVE-2026-75131)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
362456	Debian dla-4808 : network-manager-l2tp - security update	Nessus	Debian Local Security Checks	Local	high
350971	Fedora 43 : NetworkManager-l2tp (2026-1b63888725)	Nessus	Fedora Local Security Checks	Local	high
350970	Fedora 44 : NetworkManager-l2tp (2026-3a264a1bb3)	Nessus	Fedora Local Security Checks	Local	high
345722	Debian dsa-6498 : network-manager-l2tp - security update	Nessus	Debian Local Security Checks	Local	high
345668	Linux Distros Unpatched Vulnerability : CVE-2026-75131	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-75131

high

Tenable Plugins

high

high

high

high

high