How severe is CVE-2026-40224?

CVE-2026-40224 has a CVSS 3.x base score of 6.7, rated medium severity. It is exploitable over local access with high attack complexity, requires low privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2026-40224 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (1st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-40224?

CVE-2026-40224 affects Systemd Project Systemd. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-40224?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-40224 have an EU (EUVD) identifier?

Yes. CVE-2026-40224 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-21396.

When was CVE-2026-40224 published?

CVE-2026-40224 was published on 2026-04-10 and last updated on 2026-06-17.

CVE-2026-40224

CVE-2026-40224 is a medium-severity vulnerability in Systemd Project Systemd with a CVSS 3.x base score of 6.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-863.

Key facts

Severity: Medium (CVSS 3.x base score 6.7)
EPSS exploit prediction: 0% (1st percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-21396
Weakness: CWE-863
Affected product: Systemd Project Systemd
Published: 2026-04-10
Last modified: 2026-06-17

Description

In systemd 259 before 260, there is local privilege escalation in systemd-machined because varlink can be used to reach the root namespace.

Frequently asked questions

What is CVE-2026-40224?: In systemd 259 before 260, there is local privilege escalation in systemd-machined because varlink can be used to reach the root namespace.
How severe is CVE-2026-40224?: CVE-2026-40224 has a CVSS 3.x base score of 6.7, rated medium severity. It is exploitable over local access with high attack complexity, requires low privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2026-40224 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (1st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-40224?: CVE-2026-40224 affects Systemd Project Systemd. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-40224?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-40224 have an EU (EUVD) identifier?: Yes. CVE-2026-40224 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-21396.
When was CVE-2026-40224 published?: CVE-2026-40224 was published on 2026-04-10 and last updated on 2026-06-17.

References

https://github.com/systemd/systemd/security/advisories/GHSA-6pwp-j5vg-5j6m

Affected products (1)

cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:*

More vulnerabilities in Systemd Project Systemd

CVE-2022-2526 — Critical (CVSS 9.8): A use-after-free vulnerability was found in systemd. This issue occurs due to the on_stream_io() function and…
CVE-2018-21029 — Critical (CVSS 9.8): systemd 239 through 245 accepts any certificate signed by a trusted certificate authority for DNS Over TLS. Server Name…
CVE-2015-7510 — Critical (CVSS 9.8): Stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd.
CVE-2017-1000082 — Critical (CVSS 9.8): systemd v233 and earlier fails to safely parse usernames starting with a numeric digit (e.g. "0day"), running the…
CVE-2018-15688 — High (CVSS 8.8): A buffer overflow vulnerability in the dhcp6 client of systemd allows a malicious dhcp6 server to overwrite heap memory…
CVE-2023-26604 — High (CVSS 7.8): systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible…

All CVEs affecting Systemd Project Systemd →

Other CWE-863 (Incorrect Authorization) vulnerabilities

CVE-2026-48286 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Authorization…
CVE-2026-48303 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by an Incorrect Authorization…
CVE-2026-44330 — Critical (CVSS 10.0): free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the…
CVE-2026-46595 — Critical (CVSS 10.0): Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of…
CVE-2026-33105 — Critical (CVSS 10.0): Improper authorization in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over…
CVE-2026-32213 — Critical (CVSS 10.0): Improper authorization in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.

Browse all CWE-863 (Incorrect Authorization) vulnerabilities →