CVE-2026-95521

Description

A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm.

Overview

State: PUBLISHED
Assigner (CNA): redhat
CVSS severity: HIGH
CVSS score: 7.8 / 10
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Effective score: 7.8 / 10 HIGH source: CNA overview
CWE(s): CWE-78
Reserved: 2026-09-22
Published: 2026-09-24 13:26 UTC
Last updated: 2026-09-24 15:02 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95521.json
Linked Threat: CVE-2026-95521 — Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-85878
Assigner: redhat
Published: Sep 24, 2026, 1:26:56 PM
Updated: Sep 24, 2026, 3:02:40 PM
EUVD base score (CVSS 3.1): 7.8 / 10
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EUVD-reported EPSS: 0.0000
Aliases: GHSA-7prr-g333-3h48

ENISA description: A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm.

EUVD references (2)

Affected products (6)

Vendor	Product	Versions	Platforms
Red Hat	Red Hat Enterprise Linux 10	—	—
Red Hat	Red Hat Enterprise Linux 6	—	—
Red Hat	Red Hat Enterprise Linux 7	—	—
Red Hat	Red Hat Enterprise Linux 8	—	—
Red Hat	Red Hat Enterprise Linux 9	—	—
Red Hat	Red Hat Hardened Images	—	—

Vendor references (2)

References embedded in the original CVE record by the assigning CNA.

https://access.redhat.com/security/cve/CVE-2026-95521 vdb-entryx_refsource_REDHAT
RHBZ#2537812 issue-trackingx_refsource_REDHAT

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

Remediations (10)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

CVE-2026-95521 - Red Hat Customer Portal

web:access.redhat.com

Overall, you have the following options: Upgrade to a supported product version that includes a fix for this vulnerability (recommended). Apply a mitigation (if one exists). Customers with the Technical Account Manager (TAM) RHEL Security Select Add-on can review this CVE directly with their TAM.

2026-09-25 10:09 UTC
CVE-2026-95521 — Exploit & Vulnerability Details HIGH | AnonHaven

web:anonhaven.com

CVE Details CVE ID CVE-2026-95521 Published Date Sep 24, 2026 Vendor Not specified Severity HIGH CVSS v3.1 Score 7.8

2026-09-25 10:09 UTC
September 2026 Patch Breaks RDS: Fix Without Rolling Back

web:byteiota.com

That's not all. September's Patch Tuesday also fixed two zero-days under active exploitation: CVE - 2026 -85880, a heap buffer overflow in Windows ALPC that allows local privilege escalation to SYSTEM, and CVE - 2026 -81963, a link-following flaw in the Windows Update Stack. Rolling back removes those fixes too.

2026-09-25 10:09 UTC
Always On VPN Security Updates September 2026

web:directaccess.richardhicks.com

Microsoft released the September 2026 security updates today, which include numerous fixes affecting Always On VPN deployments. This month's edition addresses vulnerabilities in Windows Server Routing and Remote Access (RRAS), VPN protocols such as Secure Socket Tunneling Protocol (SSTP) and Internet Key Exchange version 2 (IKEv2). The updates also include Active Directory Certificate ...

2026-09-25 10:09 UTC
A command injection flaw was found in rpm (CVE-2026-95521)

web:exeo.net

What happened A command injection vulnerability has been identified in the rpm package management tool, affecting multiple versions of Red Hat Enterprise Linux as well as Hardened Images. The flaw, designated CVE-2026-95521 , impacts situations where source or spec files with basenames containing a % () macro are installed or rebuilt using rpm. Exploiting this flaw involves an attacker ...

2026-09-25 10:09 UTC
Security Update Guide - Microsoft Security Response Center

web:msrc.microsoft.com

Security Update Guide - Microsoft Security Response Center

2026-09-25 10:09 UTC
CISA KEV Adds 4 Critical CVEs, 3 Rated CVSS 9.8 [2026]

web:tech-insider.org

CISA added 4 critical CVEs to its KEV catalog on Aug 18, 2026 , three rated CVSS 9.8. Whats exploited, whos at risk, and how to patch fast.

2026-09-25 10:09 UTC
Patch Tuesday: Update now to fix 421 flaws, including three zero ...

web:www.malwarebytes.com

Microsoft's August 2026 Patch Tuesday addresses 421 Microsoft vulnerabilities, including 62 rated Critical. One Windows vulnerability has been exploited in the wild by the Lazarus group to gain SYSTEM privileges. The August update is smaller than July's record-breaking release, but it's still ...

2026-09-25 10:09 UTC
Oracle Critical Patch Update Advisory - July 2026

web:www.oracle.com

This Critical Patch Update contains 1448 new security patches across the product families listed below. Please note that a My Oracle Support (MOS) note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at July 2026 Critical Patch Update: Executive Summary and Analysis.

2026-09-25 10:09 UTC
CVE-2026-95521 | Tenable®

web:www.tenable.com

A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise ...

2026-09-25 10:09 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-95521.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-95521",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-24T15:01:31.439999Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-24T15:02:40.089Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "rpm",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "rpm",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "rpm",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "rpm",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "rpm",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "rpm",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Calif.io for reporting this issue."
        }
      ],
      "datePublic": "2026-09-24T12:35:33.875Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T13:26:56.782Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-95521"
        },
        {
          "name": "RHBZ#2537812",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2537812"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-18T13:29:16.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-09-24T12:35:33.875Z",
          "value": "Made public."
        }
      ],
      "title": "Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm",
      "workarounds": [
        {
          "lang": "en",
          "value": "To mitigate this issue, Red Hat recommends avoiding the installing or rebuilding of source RPMs from untrusted or unverified sources."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-95521",
    "datePublished": "2026-09-24T13:26:56.782Z",
    "dateReserved": "2026-09-22T08:44:44.967Z",
    "dateUpdated": "2026-09-24T15:02:40.089Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}