by Kastro CVE-2026-19685
Red Hat Red Hat Enterprise Linux 10 — Networkmanager: networkmanager: 802-1x ca-path and phase2-ca-path bypass private_user restriction, allowing wpa-enterprise server validation bypass (incomplete fix for cve-2025-9615)
Description · from the CVE record
NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise (802.1X) connection profile's CA path at an attacker-controlled directory, bypassing server certificate validation and enabling credential theft via a rogue access point.
Affected
ProductAffectedFixed inSource
Red Hat Enterprise Linux 10see advisory–CNA
Red Hat Enterprise Linux 6see advisory–CNA
Red Hat Enterprise Linux 7see advisory–CNA
Red Hat Enterprise Linux 8see advisory–CNA
Red Hat Enterprise Linux 9see advisory–CNA
Red Hat Hardened Imagessee advisory–CNA
Red Hat OpenShift Container Platform 4see advisory–CNA
Scores by source
CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
redhat (CNA)7.1CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total