Skip to content
Fencer Vulns
low 3.3

CVE-2025-9615 json

Networkmanager: networkmanager file access

published 2026-01-26 9 mo ago modified 2026-11-06 2 d ago also EUVD-2025-206343

cvss
3.3
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 5%
public exploits
0
none known

Summary

A flaw was found in NetworkManager. The NetworkManager package allows access to files that may belong to other users. NetworkManager allows non-root users to configure the system's network. The daemon runs with root privileges and can access files owned by users different from the one who added the connection.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 10 1:1.56.0-1.el10
  • Red Hat Red Hat Enterprise Linux 9 1:1.54.3-2.el9
  • network-manager Debian 14 1.54.3-1

debian advisories DEBIAN-CVE-2025-9615

  • network-manager Ubuntu 26.04 LTS 1.54.3-2ubuntu1

ubuntu advisories UBUNTU-CVE-2025-9615

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • NetworkManager RHEL 9 1:1.54.3-2.el9
  • NetworkManager-ovs RHEL 9 1:1.54.3-2.el9
  • NetworkManager-ppp RHEL 9 1:1.54.3-2.el9
  • NetworkManager-tui RHEL 9 1:1.54.3-2.el9
  • NetworkManager-adsl RHEL 9 1:1.54.3-2.el9
  • NetworkManager-team RHEL 9 1:1.54.3-2.el9
  • NetworkManager-wifi RHEL 9 1:1.54.3-2.el9
  • NetworkManager-wwan RHEL 9 1:1.54.3-2.el9

red hat advisories RHSA-2026:18597RHSA-2026:18142

  • NetworkManager SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 1.52.0-160000.4.1
  • NetworkManager SLE Workstation Extension 15 SP7, SLE Module for Desktop Applications 15 SP7, SLE Module for Basesystem 15 SP7 +1 more 1.44.2-150600.3.7.1
  • NetworkManager SLE Micro 5.5 1.38.6-150500.3.5.1
  • NetworkManager SLE Micro 5.4 1.38.2-150400.3.6.1
  • NetworkManager SLE Micro 5.3 1.38.2-150400.3.5.1
  • strongswan SLES for SAP applications 16.0, SLES 16.0 6.0.4-160000.1.1
  • NetworkManager Linux Micro 6.0 1.42.6-8.1
  • NetworkManager Linux Micro 6.1 1.42.6-slfo.1.1_4.1

suse advisories SUSE-SU-2026:4181-1SUSE-SU-2026:22047-1SUSE-SU-2026:22086-1SUSE-SU-2026:1443-1SUSE-SU-2026:1427-1SUSE-SU-2026:1420-1

  • NetworkManager-openvpn openSUSE Tumbleweed 1.12.5-1.1
  • NetworkManager openSUSE Leap 16.0 1.52.0-160000.4.1
  • strongswan openSUSE Leap 16.0 6.0.4-160000.1.1
  • NetworkManager-strongswan openSUSE Tumbleweed 1.6.4-1.1
  • NetworkManager-l2tp openSUSE Tumbleweed 1.52.0-1.1
  • strongswan openSUSE Tumbleweed 6.0.4-1.1

opensuse advisories openSUSE-SU-2026:11104-1openSUSE-SU-2026:20911-1openSUSE-SU-2026:20547-1openSUSE-SU-2026:10295-1openSUSE-SU-2026:10051-1openSUSE-SU-2025:15822-1

  • NetworkManager AlmaLinux 10 1:1.56.0-1.el10
  • NetworkManager-ovs AlmaLinux 10 1:1.56.0-1.el10
  • NetworkManager-ppp AlmaLinux 10 1:1.56.0-1.el10
  • NetworkManager-tui AlmaLinux 10 1:1.56.0-1.el10
  • NetworkManager-adsl AlmaLinux 10 1:1.56.0-1.el10
  • NetworkManager-wifi AlmaLinux 10 1:1.56.0-1.el10
  • NetworkManager-wwan AlmaLinux 10 1:1.56.0-1.el10
  • NetworkManager-libnm AlmaLinux 10 1:1.56.0-1.el10

almalinux advisories ALSA-2026:18142ALSA-2026:18597

  • NetworkManager Rocky Linux 10 1:1.56.0-1.el10
  • NetworkManager Rocky Linux 9 1:1.54.3-2.el9

rocky linux advisories RLSA-2026:18142RLSA-2026:18597

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-9615 updated cvss 3.3

NetworkManager: NetworkManager File Access

  • Red Hat Enterprise Linux 6 NetworkManager, NetworkManager-glib, NetworkManager-gnome
    affected: workaround, no fix planned “SELinux is shipped out of the box in targeted enforcing mode, which prevents processes from having unwanted permissions and mitigates this attack.”
  • Red Hat Enterprise Linux 7 NetworkManager, NetworkManager-ovs, NetworkManager-ppp, NetworkManager-tui, NetworkManager-adsl, NetworkManager-glib, +8 more Red Hat Enterprise Linux 8 NetworkManager, NetworkManager-ovs, NetworkManager-ppp, NetworkManager-tui, NetworkManager-adsl, NetworkManager-team, +9 more Red Hat OpenShift Container Platform 4 NetworkManager, NetworkManager-ovs, NetworkManager-ppp, NetworkManager-tui, NetworkManager-adsl, NetworkManager-team, +9 more
    affected: workaround, no fix available “SELinux is shipped out of the box in targeted enforcing mode, which prevents processes from having unwanted permissions and mitigates this attack.”
  • Red Hat Enterprise Linux AppStream (v. 9) NetworkManager-ovs 1.54.3-2.el9, NetworkManager-ppp 1.54.3-2.el9, NetworkManager-cloud-setup 1.54.3-2.el9, NetworkManager-dispatcher-routing-rules 1.54.3-2.el9, NetworkManager-config-connectivity-redhat 1.54.3-2.el9
    fixed: vendor fix “SELinux is shipped out of the box in targeted enforcing mode, which prevents processes from having unwanted permissions and mitigates this attack.” RHSA-2026:18597
  • Red Hat Enterprise Linux AppStream (v. 10) NetworkManager-ovs 1.56.0-1.el10, NetworkManager-ppp 1.56.0-1.el10, NetworkManager-cloud-setup 1.56.0-1.el10, NetworkManager-config-connectivity-redhat 1.56.0-1.el10
    fixed: vendor fix “SELinux is shipped out of the box in targeted enforcing mode, which prevents processes from having unwanted permissions and mitigates this attack.” RHSA-2026:18142
  • Red Hat Enterprise Linux BaseOS (v. 9) NetworkManager 1.54.3-2.el9, NetworkManager-tui 1.54.3-2.el9, NetworkManager-adsl 1.54.3-2.el9, NetworkManager-team 1.54.3-2.el9, NetworkManager-wifi 1.54.3-2.el9, NetworkManager-wwan 1.54.3-2.el9, +4 more
    fixed: vendor fix “SELinux is shipped out of the box in targeted enforcing mode, which prevents processes from having unwanted permissions and mitigates this attack.” RHSA-2026:18597
  • Red Hat Enterprise Linux BaseOS (v. 10) NetworkManager 1.56.0-1.el10, NetworkManager-tui 1.56.0-1.el10, NetworkManager-adsl 1.56.0-1.el10, NetworkManager-wifi 1.56.0-1.el10, NetworkManager-wwan 1.56.0-1.el10, NetworkManager-libnm 1.56.0-1.el10, +2 more
    fixed: vendor fix “SELinux is shipped out of the box in targeted enforcing mode, which prevents processes from having unwanted permissions and mitigates this attack.” RHSA-2026:18142
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) NetworkManager-debuginfo 1.54.3-2.el9, NetworkManager-debugsource 1.54.3-2.el9, NetworkManager-libnm-devel 1.54.3-2.el9, NetworkManager-ovs-debuginfo 1.54.3-2.el9, NetworkManager-ppp-debuginfo 1.54.3-2.el9, NetworkManager-tui-debuginfo 1.54.3-2.el9, +7 more
    fixed: vendor fix “SELinux is shipped out of the box in targeted enforcing mode, which prevents processes from having unwanted permissions and mitigates this attack.” RHSA-2026:18597
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) NetworkManager-debuginfo 1.56.0-1.el10, NetworkManager-debugsource 1.56.0-1.el10, NetworkManager-libnm-devel 1.56.0-1.el10, NetworkManager-ovs-debuginfo 1.56.0-1.el10, NetworkManager-ppp-debuginfo 1.56.0-1.el10, NetworkManager-tui-debuginfo 1.56.0-1.el10, +6 more
    fixed: vendor fix “SELinux is shipped out of the box in targeted enforcing mode, which prevents processes from having unwanted permissions and mitigates this attack.” RHSA-2026:18142

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
9 mo ago

Exploit prediction

0.16% chance of exploitation in the next 30 days, higher than 5% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.0 3.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected products

  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat OpenShift Container Platform 4

Classification

Weakness
  • CWE-281 Improper Preservation of Permissions

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.