Back Securityaffairs.Co

Researchers warn of unpatched, critical Telnetd flaw affecting all versions

Securityaffairs.Co •Pierluigi Paganini • March 18, 2026

CVE-2026-32746 is a critical flaw in GNU InetUtils telnetd that allows remote attackers to execute code with elevated privileges Cybersecurity company Dream disclosed a critical flaw, tracked as CVE-2026-32746 (CVSS score of 9.8), in GNU InetUtils telnetd that lets unauthenticated remote attackers execute code with elevated privileges. The issue stems from an out-of-bounds write in […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RCE Vulnerability in GNU InetUtils telnetd Exposes Systems to Attacks A critical vulnerability, CVE-2026-32746, has been discovered in the GNU InetUtils telnetd daemon, affecting all versions up to and including 2.7. This flaw allows unauthenticated remote attackers to execute arbitrary code with root privileges by sending a specially crafted message during the Telnet handshake on port 23. The vulnerability is classified as a buffer overflow and has a CVSS score of 9.8, indicating its critical nature. It poses a significant risk, especially to Industrial Control Systems (ICS) and operational technology (OT) environments where Telnet is still widely used. As of now, there are no confirmed instances of active exploitation, but the potential for imminent attacks is high due to the availability of technical details in public forums. Organizations are urged to restrict access to telnetd and consider migrating to more secure protocols like SSH. A patch is expected to be released on April 1, 2026, but until then, immediate mitigation measures are necessary. 9 sources 74

Extracted Entities

Researchers warn of unpatched, critical Telnetd flaw affecting all versions

The full story

Extracted Entities

Companies (1)

CVEs (1)

Platforms (1)