CVE-2026-4948
Medium · 5.5CVSS
5.5
EPSS
0.2%
Published
Mar 27, 2026
CISA due date
—
The record
A flaw was found in firewalld. A local unprivileged user can exploit this vulnerability by mis-authorizing two runtime D-Bus (Desktop Bus) setters, setZoneSettings2 and setPolicySettings. This mis-authorization allows the user to modify the runtime firewall state without proper authentication, leading to unauthorized changes in network security configurations.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | firewalld | 0 | 2.1.2-160000.3.1 |
Related vulnerabilities
- CVE-2026-46388 osquery is a SQL powered operating system instrumentation, monitoring, and analytics… CWE-279
- CVE-2026-20062 A vulnerability in the CLI of Cisco Secure Firewall Adaptive Security Appliance (ASA)… CWE-279
- CVE-2025-14025 A flaw was found in Ansible Automation Platform (AAP). CWE-279
- CVE-2024-25621 containerd affected by a local privilege escalation via wide permissions on CRI directory CWE-279