CVE-2026-91839

Name of the Vulnerable Software and Affected Versions NetworkManager-fortisslvpn (affected versions not specified)

Description The nm-fortisslvpn-service improperly handles carriage-return/line-feed (CR/LF) characters within VPN connection profile credentials. A local unprivileged user can exploit this by creating a malicious VPN profile to inject additional configuration directives. This flaw allows for arbitrary code execution with root privileges upon activation of the crafted VPN connection.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.