CVE-2026-72603

CVE

Threat entity extracted from intelligence sources

Frequency

4

occurrences

First Seen

August 11, 2026

Last Seen

August 12, 2026

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Critical OS Command Injection Vulnerability in wg-easy 15.3.0 Disclosed78.0

A severe OS command injection vulnerability (CVE-2026-72603) has been identified in wg-easy version 15.3.0. This flaw allows authenticated users with clients.create permission to inject newline-delimited WireGuard PostUp directives into the client name field, leading to arbitrary command execution w...

Public Exploits

Checking GitHub for proof-of-concept code…

Related Clusters (1)

Critical OS Command Injection Vulnerability in wg-easy 15.3.0 Disclosed

Aug 11·1 sources

Related Articles (4)

wg-easy wg-easy - OS Command InjectionAn OS command injection vulnerability i... CVE: New / 18h An OS command injection vulnerability in wg-easy 15.3.0 allows users with the clients.create permission to execute arbitrary commands as root by injecting newline-delimited WireGuard PostUp directives into the client name field. The client name is written to the WireGuard configuration file without neutralizing newline characters, allowing injection of arbitrary directives that are executed by wg-quic

cve.threatint.com·Aug 12

CVE-2026-72603 AKAOMA CVE VULNERABILITIES / 18h An OS command injection vulnerability in wg-easy 15.3.0 allows users with the clients.create permission to execute arbitrary commands as root by injecting newline-delimited WireGuard PostUp directives into the client name field. The client name is written to the WireGuard configuration file without neutralizing newline characters, allowing injection of arbitrary directives that are executed by wg-quick with root privileges. An attacker with clients

cve.akaoma.com·Aug 12

CVE-2026-72603 National Vulnerability Database / 10h An OS command injection vulnerability in wg-easy 15.3.0 allows users with the clients.create permission to execute arbitrary commands as root by injecting newline-delimited WireGuard PostUp directives into the client name field. The client name is written to the WireGuard configuration file without neutralizing newline characters, allowing injection of arbitrary directives that are executed by wg-quick with root privileges. An attacker with cl

nvd.nist.gov·Aug 11

CVE-2026-72603 - Exploits & Severity

Related Entities

Zero-day Exploit Command Injection WireGuard CWE-78 - OS Command Injection T1059 - Command and Scripting Interpreter Wg-easy Wg-quick Wg-quic OS Command Injection