Critical CVE Fixes for Fedora NetworkManager Plugins Released

Linuxsecurity

Critical CVE Fixes for Fedora NetworkManager Plugins Released

First seen 29 Sep 2026, 03:07 UTC • •75.8

Article Content

1 / 7

Browse articles

ThreatCluster •September 29, 2026 at 05:09 UTC

•Critical vulnerabilities in Fedora NetworkManager plugins require immediate patching.
•CISA confirmed active exploitation of these vulnerabilities in the wild.
•Affected systems include Fedora 43, 44, and 45 with specific CVEs identified.

On September 29, 2026, Fedora released critical updates for NetworkManager-l2tp and NetworkManager-iodine plugins to address vulnerabilities CVE-2026-75131, CVE-2026-93337, and CVE-2026-91837. These vulnerabilities could allow local privilege escalation and exploitation of firewall flaws, affecting Fedora 43, 44, and 45 systems. CISA confirmed that these issues are being actively exploited in the wild, prompting urgent action from system administrators. Users are advised to apply the updates immediately using the dnf package manager. The updates were published in response to confirmed exploitation attempts targeting these vulnerabilities. The patches are crucial for maintaining the security of VPN connections integrated with NetworkManager.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-09-17

CVE-2026-93337 published

A vulnerability affecting NetworkManager-l2tp was disclosed, allowing potential exploitation.

2026-09-23

CVE-2026-75131 published

Another critical vulnerability in NetworkManager-l2tp was disclosed, heightening security risks.

2026-09-25

CVE-2026-91837 published

A local privilege escalation vulnerability in NetworkManager-iodine was disclosed, affecting multiple Fedora versions.

2026-09-29

Critical updates released for Fedora

Fedora released updates for NetworkManager-l2tp and NetworkManager-iodine to address critical vulnerabilities.

More articles in this cluster (6)

Threat Graph

9 entities, 13 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

Privilege Escalation
Zero-day Exploit
T1068 - Exploitation for Privilege Escalation

Vulnerability (3)

CVE-2026-75131
CVE-2026-91837
CVE-2026-93337

Weakness (1)

CWE-269 - Improper Privilege Management

Affected Platform (2)

Linux
NetworkManager

Relationships

CVE-2026-75131 targets Linux
CVE-2026-75131 targets NetworkManager
CVE-2026-91837 targets Linux
CVE-2026-91837 targets NetworkManager
CVE-2026-93337 targets Linux
CVE-2026-93337 targets NetworkManager
Privilege Escalation targets Linux
Privilege Escalation targets NetworkManager
Zero-day Exploit targets Linux
Zero-day Exploit targets NetworkManager
T1068 - Exploitation for Privilege Escalation targets Linux
T1068 - Exploitation for Privilege Escalation targets NetworkManager
CVE-2026-75131 related to CWE-269 - Improper Privilege Management

Following this threat?

Track CVE-2026-75131 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical Zero-Day Exploits Target F5 and Check Point Products F5 Networks released emergency hotfixes for a critical zero-day vulnerability, CVE-2026-94127, in its BIG-IP Access Policy Manager on September 22, 2026, after confirming active exploitation. This flaw allows unauthenticated remote code execution (RCE) and has a CVSS score of 9.8. Concurrently, Check Point disclosed…

Critical Zero-Day Vulnerability in F5 BIG-IP APM Exploited for Remote Code Execution F5 Networks has reported a critical vulnerability in its BIG-IP Access Policy Manager (APM), tracked as CVE-2026-94127, which is being actively exploited in the wild. The flaw allows unauthenticated attackers to execute remote code on systems configured with both an APM access policy and an OAuth profile. This…