Critical RCE Vulnerability Discovered in TACACS+ Protocol

• •TACACS+ vulnerability allows pre-auth RCE attacks.
• •Exploit can be executed over the internet with minimal packets.
• •Patches available for Shrubbery Networks version; abandoned fork remains vulnerable.

A significant vulnerability has been identified in the TACACS+ protocol, allowing for pre-authentication remote code execution (RCE) attacks. This 33-year-old protocol, crucial for authentication in networking equipment, is widely used across large enterprises and ISPs. The vulnerability, detailed by Elttam, can be exploited over the internet or local networks, requiring only two packets and the ability to crack weak encryption offline. The affected systems include those using TACACS+ for authentication, which encompasses a vast array of modern networking devices. While patches have been released for the version maintained by Shrubbery Networks, the abandoned fork remains vulnerable. A CVE has been assigned (CVE-2026-87902), and the exploit is currently known to be in the wild, with at least two Chinese cyber-espionage groups reportedly exploiting this vulnerability. The disclosure process took several months, highlighting challenges in getting timely patches for legacy systems.