CVE-2026-24061: GNU InetUtils Argument Injection Vulnerability
Vulnerability summary
CVE-2026-24061 is a critical (CVSS 10.0) Improper Input Validation vulnerability in GNU InetUtils. It is known to be exploited: CISA lists it, first on 26-01-2026. EPSS estimates a 98.98% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 5 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 21-01-2026PublishedVulnerability first disclosed.
- 26-01-2026Added to CISA KEVGNU InetUtils Argument Injection Vulnerability
- 16-02-2026CISA remediation dueApply mitigations per vendor instructions.
- 29-09-2026Last modifiedVulnerability information updated.
Description
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.
CVSS metrics
5 scores · 5 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
98.98%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
+0.92 pp
From 98.06% on 19-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 26-01-2026
- Federal due date
- 16-02-2026
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. codeberg.org/inetutils/inetutils/commit/ccba9f748aa8d50a38d7748e2e60362edd6a32cc codeberg.org/inetutils/inetutils/commit/fd702c02497b2f398e739e3119bed0b23dd7aa7b nvd.nist.gov/vuln/detail/CVE-2026-24061
Public exploits
5 foundExploit Reference (openwall.com)
Maturity: unknown
Exploit Reference (redteam.ae)
Maturity: unknown
Exploit Reference (labs.greynoise.io)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
Affected systems
Debian2 products
- inetutils< 2:2.7-2 | < 2:2.4-2+deb12u2 | < 2:2.6-3+deb13u1 | < 2:2.0-1+deb11u3
- debian_linuxEOL11.0
Gnu1 product
- inetutils≥ 1.9.3, ≤ 2.7
Ubuntu1 product
- inetutils< 2:1.9.4-1ubuntu0.1~esm5 | < 2:1.9.4-3ubuntu0.1+esm4 | < 2:1.9.4-11ubuntu0.2+esm3 | < 2:2.2-2ubuntu0.2 | < 2:2.5-3ubuntu4.1 | < 2:2.6-1ubuntu3.1
3 vendors · 4 products
References
22 links- www.vicarius.io/vsociety/…Third Party Advisory
Show all 22 references
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-24061Government ResourceUS Government Resource
- www.openwall.com/lists/oss-security/2026/01/22/1Mailing List
- seclists.org/oss-sec/2026/q1/89Vendor Advisory