CVE-2026-19685
CVE-2026-19685: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityHigh7.1
High [CVE-2025-9615 +1] 802-1x ca-path and phase2-ca-path bypass private_user restriction, allowing WPA-Enterprise server validation bypass (incomplete fix for CVE-2025-9615)
CVE-2026-19685Source published Source updated
This bulletin covers 2 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.
NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise (802.1X) connection profile's CA path at an attacker-controlled directory, bypassing server certificate validation and enabling credential theft via a rogue access point. This issue is limited to WPA-Enterprise (802.1X) network connections; open and WPA2-Personal (PSK) networks are not affected. Exploitation requires an unprivileged, active local user session holding the (commonly passwordless on desktop systems) settings.modify.own polkit permission; the flaw is not reachable from a remote or inactive SSH session. NetworkManager is the sole…
- Affected products in this advisory
- Red Hat Enterprise Linux 10
- Red Hat package: networkmanager
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- Upstream fix is public: NetworkManager rejects 802-1x.ca-path and 802-1x.phase2-ca-path on private connections (those with connection.permissions) and requires ca-cert or system-ca-certs instead. Fixed upstream in commit a8e87381 (MR 2513), shipped in NetworkManager 1.58.1 and later 1.60 development snapshots. Until the fixed package is installed, use system-wide 802.1X profiles rather than per-user private ones, or set 802-1x.system-ca-certs=yes so the compiled system CA path overrides any user-supplied ca-path.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.