CVE-2026-24061
KEVCRITICAL 9.8EPSS 97.9%
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.
- CVSS v3.1
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- 97.88% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2026-01-26
- Nuclei
- critical · CWE-88
- Published
- 2026-01-21
- Updated
- 2026-03-25
Proof-of-concept exploits (58)
- SafeBreach-Labs/CVE-2026-24061207★ · 2026-01-22
- JayGLXR/CVE-2026-24061-POC67★ · 2026-01-22
- TryA9ain/CVE-2026-240619★ · 2026-01-22
- Chocapikk/CVE-2026-2406112★ · 2026-01-22
- 0p5cur/CVE-2026-24061-POC7★ · 2026-08-11
- Lingzesec/CVE-2026-24061-GUI17★ · 2026-01-28
- h3athen/CVE-2026-240617★ · 2026-01-22
- sh4den/CVE-2026-240616★ · 2026-07-06
- shivam-bathla/CVE-2026-24061-setup4★ · 2026-01-24
- balgan/CVE-2026-240613★ · 2026-01-23
- xuemian168/CVE-2026-240613★ · 2026-01-23
- duy-31/CVE-2026-24061---telnetd2★ · 2026-01-25
- Mefhika120/Ashwesker-CVE-2026-240610★ · 2026-01-23
- novitahk/Exploit-CVE-2026-240610★ · 2026-01-27
- infat0x/CVE-2026-240611★ · 2026-01-25
- r00tuser111/CVE-2026-240610★ · 2026-01-23
- Mr-Zapi/CVE-2026-240610★ · 2026-01-24
- typeconfused/CVE-2026-240610★ · 2026-01-25
- BrainBob/CVE-2026-240610★ · 2026-01-24
- LucasPDiniz/CVE-2026-240610★ · 2026-01-27
- midox008/CVE-2026-240610★ · 2026-04-28
- 0x7556/CVE-2026-240610★ · 2026-01-28
- Parad0x7e/CVE-2026-240610★ · 2026-01-28
- z3n70/CVE-2026-240610★ · 2026-01-24
- monstertsl/CVE-2026-240611★ · 2026-01-26
- punitdarji/telnetd-cve-2026-240610★ · 2026-01-26
- Alter-N0X/CVE-2026-24061-POC0★ · 2026-01-24
- ms0x08-dev/CVE-2026-24061-POC0★ · 2026-01-25
- dotelpenguin/telnetd_CVE-2026-24061_tester1★ · 2026-01-28
- FurkanKAYAPINAR/CVE-2026-24061-telnet2root1★ · 2026-01-27
- androidteacher/CVE-2026-24061-PoC-Telnetd0★ · 2026-01-27
- BrainBob/Telnet-TestVuln-CVE-2026-240610★ · 2026-01-24
- MY0723/GNU-Inetutils-telnet-CVE-2026-24061-1★ · 2026-01-28
- jacubes/CVE-2026-24061824★ · 2026-08-20
- scumfrog/cve-2026-240610★ · 2026-02-06
- SeptembersEND/CVE--2026-240610★ · 2026-02-02
- obrunolima1910/CVE-2026-240610★ · 2026-08-30
- przemytn/CVE-2026-240610★ · 2026-03-18
- lavabyte/telnet-CVE-2026-240610★ · 2026-02-04
- X-croot/CVE-2026-24061_POC2★ · 2026-02-01
- HD0x01/CVE-2026-24061-NSE0★ · 2026-03-16
- canpilayda/inetutils-telnetd-cve-2026-240610★ · 2026-02-04
- JakeSwiz/telnet-inetutils-auth-bypass-CVE-2026-240611★ · 2026-01-31
- mbanyamer/CVE-2026-24061-GNU-Inetutils-telnetd-Remote-Authentication-Bypass-Root-Shell-0★ · 2026-02-18
- K3ysTr0K3R/CVE-2026-240613★ · 2026-06-08
- harygovind/CVE-2026-240610★ · 2026-07-06
- kyukazamiqq/CVE-2026-240610★ · 2026-06-27
- anxs3c/CVE-2026-24061-GNU-InetUtils-telnetd0★ · 2026-06-08
- s-vx/CVE-2026-240610★ · 2026-07-25
- iLokaas/CVE-2026-24061-payload0★ · 2026-08-28
- hackingyseguridad/root3★ · 2026-07-17
- 0xBlackash/CVE-2026-24061
- franckferman/CVE-2026-24061
- tc4dy/CVE-2026-24061-PoC-Exploit
- tiborscholtz/CVE-2026-24061
- Collinformatics/HTB-Orion
- LKSTA/LKSDIKMEN-Cybersecurity-2026
- ridpath/Terrminus-CVE-2026-2406