Is CVE-2026-48693 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48693 being exploited in the wild.

How severe is CVE-2026-48693?

Informational severity, with a CVSS score of 7, published 26 May 2026.

Which products and versions are affected?

FastNetMon FastNetMon Community Edition through 1.2.9.

Is there a fix for CVE-2026-48693?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-48693 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-48693?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48693: FastNetMon Community Edition symlink attack in /tmp statistics file

CVE-2026-48693 · Severity: info · CVSS 7 · Published 2026-05-26

FastNetMon Community Edition, a DDoS detection tool, is vulnerable to a local security flaw that allows an attacker to overwrite critical system files. By exploiting predictable temporary file locations, a local user can trick the software into deleting or modifying files it has permission to access, typically with root privileges. This can lead to a complete system crash or unauthorized changes to system configurations.

Quick answers

Is CVE-2026-48693 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48693 being exploited in the wild.
How severe is CVE-2026-48693?: Informational severity, with a CVSS score of 7, published 26 May 2026.
Which products and versions are affected?: FastNetMon FastNetMon Community Edition through 1.2.9.
Is there a fix for CVE-2026-48693?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-48693 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-48693?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

FastNetMon Community Edition (up to v1.2.9) uses a predictable default statistics file path at /tmp/fastnetmon.dat. The function print_screen_contents_into_file() in src/fastnetmon_logic.cpp opens this path using std::ios::trunc without verifying if the path is a symbolic link or using the O_NOFOLLOW flag. Furthermore, the application sets a umask of 0 during daemonization, resulting in world-writable files, and contains a logic error in its chmod() calls. A local attacker can create a symlink at the predictable /tmp location pointing to a sensitive system file; when FastNetMon updates its statistics, it will truncate and overwrite the target file with the privileges of the FastNetMon process (often root).

Affected products

FastNetMon FastNetMon Community Edition through 1.2.9

Timeline

2026-05-23: advisory: Lorikeet Security published detailed technical blog post
2026-05-26: disclosed: CVE-2026-48693 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.