CVE-2026-10805: Rocky Linux 8 NetworkManager Local Privilege Escalation — Detection and Remediation Guide

Rocky Linux has shipped security advisory RLSA-2026-58555, addressing a local privilege escalation vulnerability in NetworkManager tracked as CVE-2026-10805. The flaw allows a local user — one who already has an unprivileged foothold on the system — to gain unauthorized elevated privileges through the network device and connection management stack.

Let's be direct about what this means in practice. Local privilege escalation (LPE) bugs rarely make headlines the way remote code execution does, but in real intrusions they are the second act of nearly every successful compromise. The attacker who lands via phishing, a web shell, or a compromised service account is almost always unprivileged on arrival. What turns that foothold into domain dominance — or in the Linux world, into root — is a reliable LPE primitive. NetworkManager is a particularly attractive target because it runs as root via systemd and D-Bus, is present on virtually every Rocky Linux 8 server and workstation by default, and historically exposes a broad attack surface through its dispatcher scripts, connection profiles, and D-Bus API.

If you operate Rocky Linux 8 systems — especially multi-user servers, jump boxes, CI/CD runners, or any host where untrusted code or users exist — this is a patch-now advisory.

Technical Analysis

Affected Platform

• Product: NetworkManager (network device and connection management daemon)
• Distribution: Rocky Linux 8 (all supported 8.x releases prior to the fixed package build)
• Component class: System daemon running with root privileges, managed by systemd, exposing control via D-Bus and the nmcli/nmtui front-ends
• Advisory: RLSA-2026-58555
• CVE: CVE-2026-10805

Vulnerability Class and Exploitation Model

Based on the advisory classification, CVE-2026-10805 is a local unauthorized privilege gain vulnerability. Defenders should model it on the well-understood NetworkManager attack surface:

1. Prerequisite access: The attacker must already have local code execution as an unprivileged user (a standard user shell, a compromised apache/nginx service account, a container escape, or a CI job context).
2. Attack vector: NetworkManager historically exposes privilege-relevant functionality through three channels: its D-Bus API (which enforces PolicyKit authorization checks), its dispatcher scripts (/etc/NetworkManager/dispatcher.d/), which execute as root on network events, and connection profile handling. Failures in authorization checks, unsafe handling of user-controlled connection data, or writable-path issues in dispatcher execution have all produced LPEs in this family of software.
3. Impact: Escalation from an unprivileged context to root (or to capabilities functionally equivalent to root), enabling persistence installation, credential theft (e.g., dumping /etc/shadow, harvesting keys from memory), disabling of EDR/audit agents, and lateral movement staging.

Because the daemon is D-Bus-accessible to local users by design, the exploitation complexity for local LPEs of this type is typically low once a technique is known. Treat the window between patch release and public PoC availability as measured in days, not months.

CVSS and Exploitation Status

The advisory does not publish a CVSS vector in the summary; local privilege escalation flaws in a root-running system daemon typically score in the High (7.x) range (local attack vector, low complexity, high impact to confidentiality/integrity/availability). At the time of writing:

• Confirmed in-the-wild exploitation: Not reported in the advisory
• CISA KEV inclusion: Not listed as of publication
• Public PoC: None confirmed — but defenders should assume rapid PoC development given the ubiquity of NetworkManager

Do not let the absence of known exploitation reduce urgency. LPEs get weaponized quietly and folded into post-exploitation frameworks quickly.

Detection & Response

For a local privilege escalation, the highest-fidelity detections focus on what exploitation and post-exploitation look like, since we cannot signature the bug itself. The key observables: the NetworkManager daemon or its dispatcher executing unexpected child processes (a classic signal that root context was abused), unprivileged users invoking privileged NetworkManager D-Bus operations, and unexpected interactive shells or tooling spawning under service contexts.

Sigma Rules

The following rules target Linux process creation telemetry (auditd, Sysmon for Linux, or equivalent). They are tuned to fire on the post-exploitation behaviors most strongly associated with abusing a root-running NetworkManager context.

---
title: NetworkManager or Dispatcher Spawning Suspicious Child Processes
id: 4b8e2a61-7c3d-4f19-9e2a-8d6f1c5b3a07
status: experimental
description: Detects the NetworkManager daemon or its dispatcher executing shells or command interpreters. Dispatcher scripts run as root; interactive shells or interpreters spawned from this lineage are a strong indicator of privilege escalation abuse (e.g., CVE-2026-10805 post-exploitation).
references:
  - https://linuxsecurity.com/advisories/rockylinux/rocky-networkmanager-rlsa-2026-58555
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/NetworkManager'
      - '/nm-dispatcher'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/socat'
      - '/nc'
      - '/ncat'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate dispatcher scripts that invoke shells for network event handling — review contents of /etc/NetworkManager/dispatcher.d/
level: high
---
title: Interactive Shell Spawned by Web or Service Account on Linux Host
id: 9f1c4d82-3b6e-4a58-b2d7-6e8a0f4c9d12
status: experimental
description: Detects common post-foothold behavior where a service account (web server, container runtime, CI agent) spawns an interactive shell — the typical staging step before attempting a local privilege escalation such as CVE-2026-10805.
references:
  - https://linuxsecurity.com/advisories/rockylinux/rocky-networkmanager-rlsa-2026-58555
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.execution
  - attack.privilege_escalation
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/httpd'
      - '/apache2'
      - '/nginx'
      - '/php-fpm'
      - '/containerd'
      - '/dockerd'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; legitimate service processes almost never spawn interactive shells
level: high
---
title: Unprivileged User Modifying NetworkManager Dispatcher Scripts
id: 2d7a5f19-8e4c-4b36-a1d9-5c3f7e2b8a46
status: experimental
description: Detects modification of NetworkManager dispatcher scripts, which execute as root on network events. Attackers who gain partial privilege or exploit authorization gaps frequently plant dispatcher scripts for root persistence.
references:
  - https://linuxsecurity.com/advisories/rockylinux/rocky-networkmanager-rlsa-2026-58555
  - https://attack.mitre.org/techniques/T1543/
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.persistence
  - attack.privilege_escalation
  - attack.t1543
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|startswith:
      - '/etc/NetworkManager/dispatcher.d/'
      - '/usr/lib/NetworkManager/dispatcher.d/'
  condition: selection
falsepositives:
  - Legitimate system administration and configuration management (Ansible, Puppet) changes — correlate with change windows
level: medium

A note on tuning: the first rule is your crown jewel here. NetworkManager dispatcher scripts legitimately execute as root, but they should almost never spawn interactive shells or interpreters in a well-managed environment. Baseline your dispatcher scripts (they are few and static on most fleets) and alert on deviations.

KQL — Microsoft Sentinel / Defender

Even for Linux estates, most mature SOCs centralize Syslog and auditd telemetry in Sentinel. The following hunt surfaces suspicious child processes of NetworkManager and dispatcher script execution across your Linux fleet ingested via Syslog or CEF. If you run Microsoft Defender for Endpoint on Linux, DeviceProcessEvents applies directly.

// Hunt: Suspicious child processes of NetworkManager / nm-dispatcher (CVE-2026-10805 post-exploitation)
// Works against MDE Linux telemetry; swap table to Syslog for agent-ingested hosts
let lookback = 7d;
let suspiciousChildren = dynamic(["/bin/bash","/bin/sh","/usr/bin/python3","/usr/bin/perl","/usr/bin/socat","/bin/nc","/usr/bin/ncat"]);
DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where InitiatingProcessFileName has_any ("NetworkManager", "nm-dispatcher")
| where FileName has_any ("bash","sh","python","perl","socat","nc","ncat")
   or ProcessCommandLine has_any ("bash -i","sh -i","/dev/tcp","pty.spawn")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine, AccountName, SHA256
| order by TimeGenerated desc;
// Companion hunt (Syslog-ingested Rocky 8 hosts): unprivileged users invoking privileged nmcli operations
Syslog
| where TimeGenerated > ago(lookback)
| where Computer has "rocky" or ProcessName has_any ("nmcli","NetworkManager","polkitd")
| where SyslogMessage has_any ("nmcli connection","dispatcher","polkit")
  and SyslogMessage has_any ("authentication","FAILED","unauthorized","denied")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc;

Velociraptor VQL

For IR scoping on suspected compromised Rocky Linux 8 hosts, this artifact enumerates NetworkManager/dispatcher lineage processes and audits dispatcher script files for unexpected content — the two fastest ways to confirm or rule out post-exploitation abuse of this component.

-- Artifact: Linux.Hunt.NetworkManagerLPE
-- Hunts for suspicious NetworkManager child processes and rogue dispatcher scripts (CVE-2026-10805 scope)
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)(NetworkManager|nm-dispatcher)'
   OR CommandLine =~ '(?i)(dispatcher\.d|nmcli connection (add|modify|up))'
   OR (Name =~ '(?i)^(bash|sh|dash|python3?|perl|socat|nc|ncat)$'
       AND Username =~ '(?i)(apache|nginx|www-data|nobody|nginx|tomcat)')

-- Companion: enumerate dispatcher scripts with modification metadata
SELECT FullPath, Size, Mtime, Ctime,
       hash(path=FullPath) AS FileHash
FROM glob(globs=['/etc/NetworkManager/dispatcher.d/*', '/usr/lib/NetworkManager/dispatcher.d/*'])
ORDER BY Mtime DESC

Cross-reference the dispatcher script list against your configuration management baseline. Any script not attributable to a change record is a priority lead.

Remediation & Verification Script

The following Bash script verifies the installed NetworkManager version, applies the RLSA-2026-58555 update, audits dispatcher scripts for anomalies, and confirms the daemon state post-patch.

#!/bin/bash
# CVE-2026-10805 (RLSA-2026-58555) — NetworkManager LPE remediation & verification for Rocky Linux 8
# Run as root. Tested targets: Rocky Linux 8.x
echo "=== [1] Current NetworkManager version ==="
rpm -q NetworkManager NetworkManager-libnm

echo "=== [2] Checking for available security update ==="
dnf updateinfo list --security 2>/dev/null | grep -i networkmanager || echo "No pending NetworkManager advisories listed"

echo "=== [3] Applying update ==="
dnf clean all -q
dnf update -y NetworkManager NetworkManager-libnm NetworkManager-team NetworkManager-tui

echo "=== [4] Post-update version (confirm against RLSA-2026-58555 fixed build) ==="
rpm -q NetworkManager
dnf updateinfo info RLSA-2026-58555 2>/dev/null | head -30

echo "=== [5] Restarting NetworkManager to load patched binaries ==="
systemctl restart NetworkManager
systemctl is-active NetworkManager

echo "=== [6] Auditing dispatcher scripts (expect only known, baseline files) ==="
ls -la /etc/NetworkManager/dispatcher.d/ /usr/lib/NetworkManager/dispatcher.d/ 2>/dev/null
echo "--- Recently modified (last 30 days) ---"
find /etc/NetworkManager/dispatcher.d/ /usr/lib/NetworkManager/dispatcher.d/ -type f -mtime -30 -exec ls -la {} \; 2>/dev/null

echo "=== [7] Checking for suspicious NetworkManager child processes ==="
ps -eo pid,ppid,user,comm,args --forest | grep -A2 -i "NetworkManager" | grep -Ei "(bash|sh|python|perl|socat|nc |ncat)" || echo "No suspicious children found"

echo "=== [8] Verifying package integrity ==="
rpm -V NetworkManager | head -20
echo "Verification complete. Any 'S.5....T' entries on binaries indicate tampering — escalate to IR."

Remediation

Primary action — patch immediately:

1. Apply the RLSA-2026-58555 update via dnf update NetworkManager (see script above). Confirm the installed build matches the fixed package version listed in the advisory at https://linuxsecurity.com/advisories/rockylinux/rocky-networkmanager-rlsa-2026-58555 and the Rocky Linux errata portal.
2. Restart the NetworkManager service (systemctl restart NetworkManager) — for a daemon-level fix, a package upgrade without service restart leaves the vulnerable binary running in memory. Schedule around connection churn on production hosts.
3. Inventory first, patch in waves: identify all Rocky Linux 8 hosts (ansible all -m setup filters, your CMDB, or rpm -q NetworkManager across the fleet). Prioritize multi-user systems, internet-adjacent jump boxes, CI/CD runners, and any host running untrusted workloads.

Hardening measures to reduce residual risk (do these regardless of patch status):

• Restrict PolicyKit authorization for NetworkManager actions. Review /etc/polkit-1/rules.d/ and limit org.freedesktop.NetworkManager.* actions to trusted groups only. Unprivileged users should not be able to create or modify system connections.
• Audit and lock down dispatcher scripts: /etc/NetworkManager/dispatcher.d/ should contain only root-owned, non-group/world-writable scripts that you can account for. Alert on any additions.
• Minimize local access: LPEs require a local foothold. Enforce least privilege on shell access, keep web-facing services patched (your first line of defense against the foothold that precedes this escalation), and ensure container workloads run with dropped capabilities and no-new-privileges flags.
• Deploy the detections above to your SIEM before patching completes — exploitation attempts during your patch window are exactly what those rules exist to catch.
• Plan the Rocky 8 lifecycle: Rocky Linux 8 maintenance support runs through May 2029, but begin your RHEL 9-family (Rocky 9) migration planning now. Newer NetworkManager builds ship with a substantially hardened codebase and benefit from faster backport cycles.

Post-patch verification: run the integrity check (rpm -V NetworkManager), review dispatcher script baselines, and sweep the last 30 days of process telemetry for the suspicious lineage patterns above. A patched system that was already escalated on is not a remediated system.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub