Back Thehackernews

Critical Unpatched Telnetd Flaw (CVE-2026-32746) Enables Unauthenticated Root RCE

Thehackernews •[email protected] (The Hacker News) • March 18, 2026

Cybersecurity researchers have disclosed a critical security flaw impacting the GNU InetUtils telnet daemon (telnetd) that could be exploited by an unauthenticated remote attacker to execute arbitrary code with elevated privileges. The vulnerability, tracked as CVE-2026-32746, carries a CVSS score of 9.8 out of 10.0. It has been described as a case of out-of-bounds write in the LINEMODE Set

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RCE Vulnerability in GNU InetUtils telnetd Exposes Systems to Attacks A critical vulnerability, CVE-2026-32746, has been discovered in the GNU InetUtils telnetd daemon, affecting all versions up to and including 2.7. This flaw allows unauthenticated remote attackers to execute arbitrary code with root privileges by sending a specially crafted message during the Telnet handshake on port 23. The vulnerability is classified as a buffer overflow and has a CVSS score of 9.8, indicating its critical nature. It poses a significant risk, especially to Industrial Control Systems (ICS) and operational technology (OT) environments where Telnet is still widely used. As of now, there are no confirmed instances of active exploitation, but the potential for imminent attacks is high due to the availability of technical details in public forums. Organizations are urged to restrict access to telnetd and consider migrating to more secure protocols like SSH. A patch is expected to be released on April 1, 2026, but until then, immediate mitigation measures are necessary. 9 sources 74

Extracted Entities

Critical Unpatched Telnetd Flaw (CVE-2026-32746) Enables Unauthenticated Root RCE

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

MITRE ATT&CK (1)

Platforms (2)