# CVE-2026-19624

## Summary

- **CVE ID:** CVE-2026-19624
- **Severity:** HIGH
- **CVSS Score:** 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- **CWE:** CWE-88
- **Published:** Sep 14, 2026
- **Last Modified:** Sep 14, 2026

## Description

A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties (vpn.data and vpn.secrets values) unescaped into a generated ipsec.conf file that pluto loads as root. A local unprivileged user can create and activate their own L2TP VPN profile containing a newline-injected leftupdown directive; pluto executes that command as root when the IKE security association is established, resulting in local privilege escalation. This is the same bug class as CVE-2018-10900 (NetworkManager-vpnc).

## Affected Products

- Unknown product (1.0.0)
- Unknown product (1.2.0)
- Unknown product (1.8.0)
- Unknown product (1.20.0)
- Unknown product (1.52.0)
- Fedora — Fedora (1.52.0)
- Fedora — Extra Packages for Enterprise Linux (EPEL) (1.20.0)

## References

- [CNA](https://github.com/nm-l2tp/NetworkManager-l2tp/commit/95b6b46f48a0c9eabc79272cd313f219110ef91c)
- [CNA](https://github.com/nm-l2tp/NetworkManager-l2tp/commit/3704d8c9d5e5f9ed1626a8ce7627a04247cea673)
- [CNA](https://github.com/nm-l2tp/NetworkManager-l2tp/releases)
- [CNA](https://bodhi.fedoraproject.org/updates/?packages=NetworkManager-l2tp)
- [CNA](https://linnemanlabs.com/posts/nm-l2tp-newline-to-root/)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.13%
- **EPSS Percentile:** 3.0

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-18._