CVE-2026-72603 AKAOMA CVE VULNERABILITIES / 18h An OS command injection vulnerability in wg-easy 15.3.0 allows users with the clients.create permission to execute arbitrary commands as root by injecting newline-delimited WireGuard PostUp directives into the client name field. The client name is written to the WireGuard configuration file without neutralizing newline characters, allowing injection of arbitrary directives that are executed by wg-quick with root privileges. An attacker with clients

Back cve.akaoma.com

CVE-2026-72603 AKAOMA CVE VULNERABILITIES / 18h An OS command injection vulnerability in wg-easy 15.3.0 allows users with the clients.create permission to execute arbitrary commands as root by injecting newline-delimited WireGuard PostUp directives into the client name field. The client name is written to the WireGuard configuration file without neutralizing newline characters, allowing injection of arbitrary directives that are executed by wg-quick with root privileges. An attacker with clients

cve.akaoma.com • August 12, 2026

Share: View original

9.9 /10 Critical Risk As a catastrophic security flaw, CVE-2026-72603 has severe implications, demanding immediate intervention.

As a catastrophic security flaw, CVE-2026-72603 has severe implications, demanding immediate intervention.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical OS Command Injection Vulnerability in wg-easy 15.3.0 Disclosed A severe OS command injection vulnerability (CVE-2026-72603) has been identified in wg-easy version 15.3.0. This flaw allows authenticated users with clients.create permission to inject newline-delimited WireGuard PostUp directives into the client name field, leading to arbitrary command execution with root privileges. The vulnerability arises because the client name is written to the WireGuard configuration file without neutralizing newline characters. Currently, there is no public proof-of-concept or evidence of exploitation. The CVSS base score assigned to this vulnerability is 9.9, indicating critical severity. Users are advised to update to a patched version and restrict permissions to trusted users. The vulnerability was published on August 11, 2026. 1 sources 78

Extracted Entities

Attack Types (1)

Zero-day Exploit

Companies (1)

CVEs (1)

CWE Weaknesses (1)

CWE-78 - OS Command Injection

MITRE ATT&CK (1)

T1059 - Command and Scripting Interpreter

Platforms (2)

Wg-easy Wg-quick