cve.akaoma.com Critical OS Command Injection Vulnerability in wg-easy 15.3.0 Disclosed
Article Content
- •CVE-2026-72603 is a critical OS command injection vulnerability in wg-easy 15.3.0.
- •Authenticated users can execute arbitrary commands as root by exploiting this flaw.
- •Immediate updates and permission restrictions are recommended to mitigate risks.
A severe OS command injection vulnerability (CVE-2026-72603) has been identified in wg-easy version 15.3.0. This flaw allows authenticated users with clients.create permission to inject newline-delimited WireGuard PostUp directives into the client name field, leading to arbitrary command execution with root privileges. The vulnerability arises because the client name is written to the WireGuard configuration file without neutralizing newline characters. Currently, there is no public proof-of-concept or evidence of exploitation. The CVSS base score assigned to this vulnerability is 9.9, indicating critical severity. Users are advised to update to a patched version and restrict permissions to trusted users. The vulnerability was published on August 11, 2026.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (5)
Following this threat?
Track WireGuard and CVE-2026-72603 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical RCE Vulnerability in Langflow Exposed CVE-2026-105740 is a critical remote code execution (RCE) vulnerability affecting Langflow versions prior to 1.9.0. Authenticated users can exploit this flaw by adding an MCP server with the 'Stdio' transport, allowing arbitrary OS commands to be executed without validation. The vulnerability was published on October… 
OS Command Injection Flaw in SiteGuard WAF Exploited EG Secure Solutions disclosed that attackers are exploiting an OS command injection vulnerability in SiteGuard Server Edition, tracked as CVE-2026-106931. This flaw allows attackers to execute commands with root or SYSTEM privileges, affecting versions 2.20 and later, with the statistics feature enabled by default.…