External risk intelligence

NetworkManager Local Privilege Escalation via CA Path Manipulation

CVE advisorySeverity: HIGH (CVSS 7.1)

CVE-2026-19685

This vulnerability requires an unprivileged local user on the system to manipulate local connection profile properties. It is a client-side configuration issue related to NetworkManager that does not involve public-facing network services or remote accessibility.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This CVE involves a flaw in how NetworkManager handles certain network security settings, specifically for WPA-Enterprise connections. An unprivileged user on a system could potentially exploit this to bypass security checks, which could lead to the theft of user credentials if they connect to a malicious Wi-Fi network.

Local users can bypass network security checks.
Allows credential theft on rogue networks.
Confirm relevance and exposure in your environment.

Attack Path

How an attacker could exploit the issue

An unprivileged local user can exploit this vulnerability by manipulating NetworkManager connection settings. This allows them to trick the system into trusting a malicious Wi-Fi network, potentially leading to the theft of user credentials.

Requires local user access.
Modifies network connection settings.
Risks credential theft and network compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unprivileged local user to bypass server certificate validation for WPA-Enterprise connections, potentially leading to credential theft. This occurs when the user manipulates connection profile settings to point CA paths at attacker-controlled directories, especially when supported by NetworkManager's configuration.

User credentials and network access.
Local user manipulates connection profile settings.
Credential theft via rogue access point.

Operational Fix

Recommended remediation, mitigation, and detection steps

NetworkManager's handling of 802.1x certificate paths is susceptible to local privilege escalation, allowing unprivileged users to bypass server certificate validation and steal credentials. System owners and infrastructure teams should prioritize identifying affected systems, assessing their reachability and criticality, and confirming ownership before planning remediation.

Network infrastructure and platform teams own this.
Verify NetworkManager configuration and potential user manipulation.
Plan remediation or mitigation based on exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is NetworkManager?

NetworkManager is a core software component used in Linux-based operating systems to manage and configure network connections. It handles a wide range of tasks, such as connecting to Wi-Fi, managing Ethernet devices, and configuring complex WPA-Enterprise (802.1X) authentication profiles that require specific security certificates.

What does CVE-2026-19685 mean for security?

This vulnerability is classified as CWE-863, which pertains to incorrect authorization. Essentially, NetworkManager fails to properly enforce restrictions on certain directory paths used for security certificates. Because this check is missing, a local user can override the intended security settings to bypass server certificate validation.

How is this vulnerability triggered?

An attacker must have local, unprivileged access to the system to modify a specific connection profile. By changing the CA path settings to point toward a directory they control, they can intercept credentials. Simply having a standard connection profile or browsing the internet does not trigger this; it requires deliberate, unauthorized manipulation of the NetworkManager configuration files.

Is my system at risk if it is internet-facing?

According to Halo Surface Signal, this risk is very unlikely to be remotely triggered. Because the vulnerability requires an unprivileged local user to manipulate internal configuration settings, it does not involve public-facing services. The threat is contained to the local system environment rather than external network exposure.

How do I protect systems from this issue?

Your first step is to identify systems running NetworkManager that support WPA-Enterprise connections. Review your security policies regarding local user permissions, as the attack requires access to modify connection profiles. Prioritize patching the NetworkManager software once an update is available from your Linux distribution, and monitor for unauthorized changes to network configuration settings.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.