An update for NetworkManager is now available for openEuler-22.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-3661 Final 1.0 1.0 2026-09-05 Initial 2026-09-05 2026-09-05 openEuler SA Tool V1.0 2026-09-05 NetworkManager security update An update for NetworkManager is now available for openEuler-22.03-LTS-SP4 NetworkManager attempts to keep an active network connection available at all times. The point of NetworkManager is to make networking configuration and setup as painless and automatic as possible. If using DHCP, NetworkManager is intended to replace default routes, obtain IP addresses from a DHCP server, and change name servers whenever it sees fit. Security Fix(es): NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise (802.1X) connection profile's CA path at an attacker-controlled directory, bypassing server certificate validation and enabling credential theft via a rogue access point.(CVE-2026-19685) An update for NetworkManager is now available for openEuler-22.03-LTS-SP4. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High NetworkManager https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3661 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-19685 https://nvd.nist.gov/vuln/detail/CVE-2026-19685 openEuler-22.03-LTS-SP4 NetworkManager-1.32.12-26.oe2203sp4.x86_64.rpm NetworkManager-bluetooth-1.32.12-26.oe2203sp4.x86_64.rpm NetworkManager-debuginfo-1.32.12-26.oe2203sp4.x86_64.rpm NetworkManager-debugsource-1.32.12-26.oe2203sp4.x86_64.rpm NetworkManager-libnm-1.32.12-26.oe2203sp4.x86_64.rpm NetworkManager-libnm-devel-1.32.12-26.oe2203sp4.x86_64.rpm NetworkManager-ppp-1.32.12-26.oe2203sp4.x86_64.rpm NetworkManager-team-1.32.12-26.oe2203sp4.x86_64.rpm NetworkManager-wifi-1.32.12-26.oe2203sp4.x86_64.rpm NetworkManager-wwan-1.32.12-26.oe2203sp4.x86_64.rpm NetworkManager-config-server-1.32.12-26.oe2203sp4.noarch.rpm NetworkManager-help-1.32.12-26.oe2203sp4.noarch.rpm NetworkManager-1.32.12-26.oe2203sp4.aarch64.rpm NetworkManager-bluetooth-1.32.12-26.oe2203sp4.aarch64.rpm NetworkManager-debuginfo-1.32.12-26.oe2203sp4.aarch64.rpm NetworkManager-debugsource-1.32.12-26.oe2203sp4.aarch64.rpm NetworkManager-libnm-1.32.12-26.oe2203sp4.aarch64.rpm NetworkManager-libnm-devel-1.32.12-26.oe2203sp4.aarch64.rpm NetworkManager-ppp-1.32.12-26.oe2203sp4.aarch64.rpm NetworkManager-team-1.32.12-26.oe2203sp4.aarch64.rpm NetworkManager-wifi-1.32.12-26.oe2203sp4.aarch64.rpm NetworkManager-wwan-1.32.12-26.oe2203sp4.aarch64.rpm NetworkManager-1.32.12-26.oe2203sp4.src.rpm NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise (802.1X) connection profile's CA path at an attacker-controlled directory, bypassing server certificate validation and enabling credential theft via a rogue access point. 2026-09-05 CVE-2026-19685 openEuler-22.03-LTS-SP4 High 7.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N NetworkManager security update 2026-09-05 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3661