Fluid Attacks Database

Description

NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise (802.1X) connection profile's CA path at an attacker-controlled directory, bypassing server certificate validation and enabling credential theft via a rogue access point.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 14	network-manager	=1.52.1-1 \|\| =1.54.0-1 \|\| =1.54.0-2 \|\| =1.54.0-3 \|\| =1.54.0-4 \|\| =1.54.1-1 \|\| =1.54.2-1 \|\| =1.54.2-2 \|\| =1.54.2-3 \|\| =1.54.3-1 \|\| =1.54.3-2 \|\| =1.56.0-1 \|\| =1.56.0-2 \|\| =1.56.0-3 \|\| =1.56.0-4 \|\| =1.56.0-5 \|\| =1.56.0-6 \|\| =1.56.0-7 \|\| =1.56.1-1 \|\| =1.58.0-1 \|\| =1.58.0-2 \|\| =1.58.0-3 \|\| =1.58~rc1-1 \|\| >=0 <1.58.1-1	1.58.1-1
rpm rhel10	NetworkManager	-	-

Aliases

1. CVE-2026-196852. NVD-2026-196853. OSV-DEBIAN-2026-196854. OSV-2026-196855. SECURITY-TRACKER-CVE-2026-19685

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.