Is CVE-2026-12505 actively exploited?

No active exploitation of CVE-2026-12505 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-12505 be exploited remotely?

No. CVE-2026-12505 requires local access to exploit.

What is the CVSS score of CVE-2026-12505?

CVE-2026-12505 has a CVSS score of 7.8 (HIGH).

HOME VULNERABILITIESCVE-2026-12505

HIGH

CVE-2026-12505

CWE-250Published: June 18, 2026· Updated: Jun 22, 2026

7.8

CVSS v3.1

Official Description

A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root privileges before looking up user information inside a user-controlled environment. A local, low privileged attacker can exploit this by using a crafted request_key payload to trick the root-owned helper into entering a custom environment (namespace) containing a malicious NSS module. This forces the system to load the attacker's controlled NSS Module and configuration, allowing them to execute arbitrary commands as the root user, elevating their privileges and fully compromising the system.

NVD Source

Technical Analysis

CVE-2026-12505 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.8.