CVE-2026-16742: systemd systemd-homed Improper Privilege Management
CVSS: 6.7v3.1MediumAwaiting analysis
AliasesUBUNTU-CVE-2026-16742DEBIAN-CVE-2026-16742
Published 10-08-2026Last modified 10-08-2026
Vulnerability summary
CVE-2026-16742 is a medium (CVSS 6.7) Improper Privilege Management vulnerability in systemd systemd-homed. EPSS estimates a 0.06% chance of exploitation in the next 30 days, higher than 0% of scored vulnerabilities.
CVSS score
6.7/10
010
Medium · v3.1 (CVE.org)EPSS score
0.06%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 4 · Related 5Timeline
- 10-08-2026PublishedVulnerability first disclosed.
- 10-08-2026Last modifiedVulnerability information updated.
Description
systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user
CVSS metrics
4 scores · 4 sources · 1 versionMedium 6.7Preferred score · CVE.org (CNA)
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:HSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated6.7MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated6.7MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
- NVDNIST6.7MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.06%
Chance of exploitation in the next 30 days
Percentile
0%
Versus all other CVEs
30-day change
0.00 pp
From 0.06% on 19-09-2026
19-09-202619-10-2026
EPSS score0.06%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
- CWE-347Improper Verification of Cryptographic SignatureThe product does not verify, or incorrectly verifies, the cryptographic signature for data.
Affected systems
Debian1 product
- systemdAll versions (No fix recorded) | < 261.2-1
Systemd1 product
- systemd-homed≥ 245, < 262, 261.2, 260.4, 259.8, 258.10
Ubuntu1 product
- systemd< 249.11-0ubuntu3.22 | < 255.4-1ubuntu8.17 | < 259.5-0ubuntu3.4
3 vendors · 3 products
