Skip to content
Critical RCE Vulnerability Discovered in TACACS+ Protocol

Critical RCE Vulnerability Discovered in TACACS+ Protocol

First seen 25 Sep 2026, 05:22 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 1, 2026 at 10:45 UTC
  • •A pre-authentication RCE vulnerability in TACACS+ allows attackers to execute code remotely.
  • •The vulnerability affects a wide range of networking equipment used in enterprises and ISPs.
  • •Elttam has released a patch, but the original code remains unpatched and vulnerable.

A significant vulnerability has been identified in the TACACS+ protocol, allowing pre-authentication remote code execution (RCE) attacks. This 33-year-old protocol, widely used for authentication in networking equipment, is vulnerable due to a format string flaw in its code. Elttam, an Australian security firm, reported that attackers can exploit this vulnerability to execute malicious code on TACACS+ servers without prior authentication. The attack can be carried out over the internet or a local network, requiring only two packets. The vulnerability affects a vast number of enterprise, ISP, and cloud provider networks that utilize TACACS+ for authentication. Elttam has released a patch, but the original codebase remains. As of now, this vulnerability has not been assigned a CVE number, but it is expected to be critical once officially documented.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 39d ago How this analysis works

Timeline

2026-09-25
Vulnerability disclosed by Elttam
Elttam published details of a pre-authentication RCE vulnerability in TACACS+, affecting numerous networks globally.
Elttam
2026-09-25
Risky Bulletin reports vulnerability
News.Risky.Biz covered the vulnerability, highlighting its potential impact on modern networking equipment.
News.Risky.Biz

More articles in this cluster (2)

Following this threat?

Track TacTap, Cisco and CVE-2023-45239 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (11)

1 / 4

Common questions

What is the nature of the vulnerability?
The vulnerability allows for pre-authentication remote code execution on TACACS+ servers.
Who is affected by this vulnerability?
Organizations using TACACS+ for authentication on their networking equipment are at risk.
Is there a patch available?
Yes, Elttam has released a patch for the vulnerability, but the original code remains unpatched.