Is CVE-2026-40224 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40224 being exploited in the wild.

How severe is CVE-2026-40224?

Medium severity, with a CVSS score of 6.7, published 10 April 2026.

Which products and versions are affected?

systemd project systemd-machined 259 before 260, 259.3.

Is there a fix for CVE-2026-40224?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-40224 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-40224?

Check whether you run Systemd Project Systemd. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40224: systemd systemd-machined local privilege escalation via Varlink

CVE-2026-40224 · Severity: medium · CVSS 6.7 · Published 2026-04-10

A security vulnerability in systemd-machined, a service used to manage virtual machines and containers, allows a standard user logged into a desktop session to gain full administrative (root) control of the system. This issue occurs when an attacker uses a specific communication protocol to bypass security boundaries and reach the core system namespace. An exploit could lead to a total compromise of the machine's data and operations, though it typically requires the attacker to have local access to a graphical desktop session.

Technologies: Systemd Project Systemd. Vendors: Systemd Project.

Quick answers

Is CVE-2026-40224 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40224 being exploited in the wild.
How severe is CVE-2026-40224?: Medium severity, with a CVSS score of 6.7, published 10 April 2026.
Which products and versions are affected?: systemd project systemd-machined 259 before 260, 259.3.
Is there a fix for CVE-2026-40224?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-40224 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-40224?: Check whether you run Systemd Project Systemd. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A local privilege escalation vulnerability exists in systemd-machined versions 259 through 259.2. The flaw is rooted in incorrect authorization (CWE-863) where Varlink IPC calls can be leveraged to reach the root namespace from an unprivileged context. To exploit this, an attacker must be an unprivileged user logged into a local desktop graphical session; remote sessions like SSH are reportedly unaffected. Successful exploitation allows the user to escalate privileges to root. The issue is addressed in systemd version 260 and backported to 259.3. A workaround involves implementing a Polkit rule to restrict 'org.freedesktop.machine1.register-machine' actions to administrative users.

Affected products

systemd project systemd-machined 259 before 260, 259.3

Timeline

2026-03-04: advisory: Vendor advisory published on GitHub
2026-04-10: disclosed: CVE published to NVD
2026-04-27: other: NVD analysis and CPE enrichment completed

References

https://github.com/systemd/systemd/security/advisories/GHSA-6pwp-j5vg-5j6m

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.