Networkmanager L2tp Privilege Escalation Via Pppd Plugin Injection

Back www.vulncheck.com

Networkmanager L2tp Privilege Escalation Via Pppd Plugin Injection

www.vulncheck.com • September 18, 2026

Share: View original

CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

GitHub Security Advisory (GHSA-rp84-8h2r-5xc3)

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical CVE-2026-93337 in NetworkManager-l2tp Allows Root Code Execution A vulnerability identified as CVE-2026-93337 in NetworkManager-l2tp permits local users to exploit improper input validation of VPN properties, specifically mru and mtu. This flaw enables attackers to inject arbitrary pppd directives, leading to arbitrary code execution with root privileges. The issue affects Linux endpoints and servers where non-administrative users can create VPN connections. The vulnerability has been confirmed on Debian 13 and is considered a high-risk local privilege escalation. A proof-of-concept demonstrating the exploit has been developed, indicating reliable exploitation potential. Administrators are urged to apply patches promptly and restrict VPN connection creation to trusted users until a fix is implemented. Monitoring for unusual changes in PPP options files is also recommended. The vulnerability was published on September 17, 2026, and is currently not confirmed to be actively exploited in the wild. 2 sources 67

Extracted Entities

CWE Weaknesses (1)

CWE-88 - Argument Injection

Vulnerabilities (1)

Networkmanager L2tp Privilege Escalation Via Pppd Plugin Injection