AUGUST 14, 2026
Live Feed
Back to database
Case File

CVE-2026-72603

CRITICAL · CVSS 9.9 EPSS 2.13% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-11 · Last synced 2026-08-14

CyberRota Analysis

AI-Generated

An OS command injection vulnerability in wg-easy version 15.3.0 allows users with the clients.create permission to execute arbitrary commands as root by injecting newline characters into the client name field. This flaw enables attackers to manipulate the WireGuard configuration file, leading to potential root code execution on the host system. Organizations using wg-easy should prioritize patching this vulnerability to mitigate the risk of unauthorized access and system compromise.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals
code execution
GitHub PoC Links

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-72603
Severity
CRITICAL
CVSS
9.9
EPSS
2.13%

Original NVD Description

An OS command injection vulnerability in wg-easy 15.3.0 allows users with the clients.create permission to execute arbitrary commands as root by injecting newline-delimited WireGuard PostUp directives into the client name field. The client name is written to the WireGuard configuration file without neutralizing newline characters, allowing injection of arbitrary directives that are executed by wg-quick with root privileges. An attacker with clients.create permission achieves root code execution on the host.