CVE-2025-9615

LOW

Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4 - Unauthorized File Access via NetworkManager

Title source: llm

Description

A flaw was found in NetworkManager. The NetworkManager package allows access to files that may belong to other users. NetworkManager allows non-root users to configure the system's network. The daemon runs with root privileges and can access files owned by users different from the one who added the connection.

References (7)

Core 7

Core References

Vendor Advisory vdb-entry x_refsource_redhat

https://access.redhat.com/security/cve/CVE-2025-9615

Issue Tracking issue-tracking x_refsource_redhat

https://bugzilla.redhat.com/show_bug.cgi?id=2391503

Issue Tracking

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/1809

Issue Tracking

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2324

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:18142

https://access.redhat.com/errata/RHSA-2026:18142

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:18597

https://access.redhat.com/errata/RHSA-2026:18597

Issue Tracking

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2327

Scores

CVSS v3 3.3

EPSS 0.0016

EPSS Percentile 5.8%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-281

Status published

Products (8)

Red Hat/Red Hat Enterprise Linux 10

Red Hat/Red Hat Enterprise Linux 10 1:1.56.0-1.el10

Red Hat/Red Hat Enterprise Linux 6

Red Hat/Red Hat Enterprise Linux 7

Red Hat/Red Hat Enterprise Linux 8

Red Hat/Red Hat Enterprise Linux 9

Red Hat/Red Hat Enterprise Linux 9 1:1.54.3-2.el9

Red Hat/Red Hat OpenShift Container Platform 4

Published Jan 26, 2026

Tracked Since Feb 18, 2026