CVE-2026-12505

HighCVSS 7.8

Published: 18/06/2026(UTC)Updated: 04/11/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

5th percentile - higher than 5% of all known CVEs

Summary

Risk Assessment

The risk for the organization is critical, as a local unprivileged attacker can gain full root control over the system, executing arbitrary commands and fully compromising it.

Recommendation

It is recommended to immediately update the cifs-utils package to the latest patched version and restrict local access to the system for untrusted users.

Other vulnerabilities in cifs-utils

CVE-2026-104715High
A flaw in cifs-utils allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a CIFS share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. An attacker can inject unauthorized mount options, bypassing permission checks and executing files with root privileges.

Original NVD description (English source)

A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root privileges before looking up user information inside a user-controlled environment. A local, low privileged attacker can exploit this by using a crafted request_key payload to trick the root-owned helper into entering a custom environment (namespace) containing a malicious NSS module. This forces the system to load the attacker's controlled NSS Module and configuration, allowing them to execute arbitrary commands as the root user, elevating their privileges and fully compromising the system.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS