Is CVE-2026-44932 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44932 being exploited in the wild.

How severe is CVE-2026-44932?

High severity, with a CVSS score of 8.8, published 16 June 2026.

Which products and versions are affected?

Opensuse Leap 15.4, 15.5, 15.6; Opensuse Wicked before 0.6.79; Suse Linux Enterprise Server 15 SP4, 15 SP5, 15 SP6.

Is there a fix for CVE-2026-44932?

A patch was published on 2026-06-10: SUSE released security updates for SLE and Leap products Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44932 attacked?

It is attacked from the adjacent network, in an operating system.

Am I affected by CVE-2026-44932?

Check whether you run Opensuse Leap, Opensuse Wicked or Suse Linux Enterprise Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44932: openSUSE wicked command injection via unsanitized DHCP options

CVE-2026-44932 · Severity: high · CVSS 8.8 · Published 2026-06-16

A vulnerability in the wicked network configuration tool, used in various SUSE and openSUSE Linux distributions, could allow an attacker to take control of a system. By operating a malicious DHCP server on the same local network, an attacker can send specially crafted network configuration data that triggers the execution of unauthorized commands. This could lead to a full system compromise, especially in environments using remote disk mounting or early-boot network services.

Technologies: Opensuse Leap, Opensuse Wicked, Suse Linux Enterprise Server. Vendors: Opensuse, Suse.

Quick answers

Is CVE-2026-44932 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44932 being exploited in the wild.
How severe is CVE-2026-44932?: High severity, with a CVSS score of 8.8, published 16 June 2026.
Which products and versions are affected?: Opensuse Leap 15.4, 15.5, 15.6; Opensuse Wicked before 0.6.79; Suse Linux Enterprise Server 15 SP4, 15 SP5, 15 SP6.
Is there a fix for CVE-2026-44932?: A patch was published on 2026-06-10: SUSE released security updates for SLE and Leap products Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44932 attacked?: It is attacked from the adjacent network, in an operating system.
Am I affected by CVE-2026-44932?: Check whether you run Opensuse Leap, Opensuse Wicked or Suse Linux Enterprise Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A command injection vulnerability exists in the wicked DHCP client due to improper neutralization of special elements in DHCP options. When processing options like POSIXTZSTRING, the client writes unsanitized values into leaseinfo files (e.g., /run/wicked/leaseinfo.*) enclosed in single quotes but without escaping. If these files are subsequently sourced by shell scripts—such as those in dracut's network-legacy module or cloud-netconfig—an attacker on the adjacent network can achieve arbitrary code execution as root. The issue is fixed in wicked version 0.6.79 by implementing proper single-quote escaping and stricter character validation for specific RFC4833 options.

Affected products

openSUSE wicked before 0.6.79
SUSE SUSE Linux Enterprise Server 15 SP4, 15 SP5, 15 SP6
openSUSE openSUSE Leap 15.4, 15.5, 15.6

Timeline

2026-05-13: disclosed: Vulnerability reported to SUSE by Wolfgang Frisch
2026-06-10: patched: SUSE released security updates for SLE and Leap products
2026-06-15: patched: wicked version 0.6.79 released on GitHub
2026-06-16: advisory: CVE-2026-44932 published in NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.