Arbitrary Code Execution Vulnerability in Ubuntu Plasma Workspace

Linuxsecurity

Arbitrary Code Execution Vulnerability in Ubuntu Plasma Workspace

First seen 29 Sep 2026, 21:04 UTC • •72.0

Article Content

1 / 3

Browse articles

ThreatCluster •September 29, 2026 at 21:05 UTC

•Vulnerability allows arbitrary code execution on Ubuntu 16.04 Plasma Workspace.
•Local attackers can exploit improper authentication to access user sessions.
•Users should update to the latest plasma-workspace version to mitigate risks.

A vulnerability has been identified in the Plasma Workspace for Ubuntu 16.04, allowing local attackers to execute arbitrary code as another user. Discovered by Fabian Vogt, the flaw arises from improper authentication of local clients connecting to the session manager. This vulnerability affects users of Ubuntu 16.04 LTS and can lead to unintended access to user sessions. To mitigate the risk, users are advised to update to plasma-workspace version 4:5.5.5.2-0ubuntu1.1+esm1, available through Ubuntu Pro. A standard system update will also apply necessary changes. The issue has been confirmed by CISA, indicating potential exploitation in the wild. Users are encouraged to check if their systems require the fix.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-09-28

Vulnerability disclosed

Fabian Vogt reported a flaw in Plasma Workspace affecting Ubuntu 16.04, allowing arbitrary code execution.

2026-09-29

CISA confirms exploitation

CISA confirmed that the vulnerability is being exploited in the wild, urging users to apply updates.

More articles in this cluster (2)

Threat Graph

4 entities, 3 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (1)

Zero-day Exploit

Organization (1)

Ubuntu

Weakness (1)

CWE-269 - Improper Privilege Management

Affected Platform (1)

Linux

Relationships

Zero-day Exploit targets Linux
Zero-day Exploit related to Ubuntu
Zero-day Exploit related to CWE-269 - Improper Privilege Management

Following this threat?

Track Ubuntu in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical Zero-Day Exploits Target F5 and Check Point Products F5 Networks released emergency hotfixes for a critical zero-day vulnerability, CVE-2026-94127, in its BIG-IP Access Policy Manager on September 22, 2026, after confirming active exploitation. This flaw allows unauthenticated remote code execution (RCE) and has a CVSS score of 9.8. Concurrently, Check Point disclosed…

Critical Citrix NetScaler Zero-Day Vulnerabilities Exploited Citrix disclosed two critical zero-day vulnerabilities, CVE-2026-88771 and CVE-2026-88772, affecting NetScaler ADC and Gateway systems, which are being actively exploited. Both vulnerabilities have a CVSS score of 9.5 and allow unauthenticated attackers to execute arbitrary commands remotely. CVE-2026-88771 arises…