Back Linuxsecurity

SUSE 15 SP7 libzypp Critical Security Issues Advisory 2026-4092

Linuxsecurity •LinuxSecurity Advisories • September 9, 2026

Keep your Linux systems secure and up to date with practical patching guidance. Review Linux Patching Best Practices ×

## This update for libzypp, zypper fixes the following issues: Security issue fixed: * invalidating legacy libzypp unsigned-repository cache state [LIBZYPP-LEGACY- CACHE-01] (bsc#1274625). * hasCredentials() requires both username AND password to be non-empty (bsc#1273242). * GPG Key hints in repoindex.xml require at least a long id to allow auto- import (bsc#1271730). Non security issues fixed: * Econf parser adds tags in drop-in files outside any section to [main] (bsc#1272534). * libzypp: X-ZYpp-AnonymousId header anomaly (bsc#1268321). * Need zypper option to disable services to fix Dockerfile builds in OBS (bsc#1257249). * zypper loads repository data and installed packages prior to checking for required arguments (bsc#1274091).

* Basesystem Module 15-SP7

* SUSE Linux Enterprise Desktop 15 SP7

* SUSE Linux Enterprise Real Time 15 SP7

* SUSE Linux Enterprise Server 15 SP7

* SUSE Linux Enterprise Server for SAP Applications 15 SP7

An update that has nine security fixes can now be installed.

Announcement ID: SUSE-SU-2026:4092-1 Release Date: 2026-09-08T16:31:50Z Rating: critical

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Security Fix for openSUSE and SUSE libzypp zypper Vulnerabilities On September 9, 2026, SUSE released a critical security update (SUSE-SU-2026-4112) for libzypp and zypper, addressing multiple vulnerabilities affecting various SUSE Linux distributions, including openSUSE 15.6 and SUSE Linux Enterprise 15 SP6. The vulnerabilities include issues with the legacy unsigned-repository cache state, credential handling, and GPG key hints, which could potentially allow unauthorized access or manipulation of repository data. The update fixes three critical security issues and several non-security bugs. Affected systems include SUSE Linux Enterprise Server, Desktop, and High-Performance Computing editions. Users are urged to apply the patches immediately to mitigate risks. The vulnerabilities were reported under various bug tracking IDs, including bsc#1274625 and bsc#1271730. The patches can be installed using standard SUSE installation methods such as YaST or zypper commands. The update is critical, and users should prioritize applying it to ensure system security. 7 sources 72

Extracted Entities

Platforms (5)

Basesystem Module 15-sp7 SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Real Time 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server For SAP Applications 15 SP7