CVE-2026-19685 is a high severity (CVSS 7.1) flaw in NetworkManager. The private_user restriction was not applied to the 802-1x.ca-path and phase2-ca-path properties, so a local user could weaken certificate validation on a private WPA-Enterprise profile. The upstream fix is in NetworkManager 1.58.1 and later.
What's affected
NetworkManager, in versions before the fix, on systems where users can hold private 802.1X (WPA-Enterprise) connection profiles. The Red Hat page we read says the upstream fix landed in NetworkManager 1.58.1 and later, and in 1.60 development snapshots. It did not list distribution package versions, so check your vendor's advisory for the build that carries the fix.
This is an incomplete fix for CVE-2025-9615. The record's products list is empty, so use the Red Hat and upstream pages to decide whether your distribution ships an affected build.
Severity: the record scores it 7.1 (High). Red Hat gives the same 7.1 with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. Red Hat also states that a 9.8 score attributed to CISA is incorrect. We flag that so you are not surprised if you see 9.8 elsewhere. The weakness is CWE-863 (incorrect authorization). KEV flag is false.
Exploitation needs a local user with permission to modify their own settings. Red Hat says it is not reachable from a remote or inactive SSH session.
How to check if you're exposed
Check the installed version:
NetworkManager --version
Then look for private enterprise Wi-Fi profiles that set a CA directory. For a profile named corp, this shows the relevant properties:
nmcli -f 802-1x.ca-path,802-1x.phase2-ca-path,802-1x.system-ca-certs connection show corp
A profile owned by one user that points the CA path at a directory you do not recognise deserves a closer look. On shared workstations, such as lab machines or multi-user terminals, the risk is higher than on a single user laptop. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers application dependencies, so it will not see operating system, firmware or driver issues like this one. For those, rely on your asset inventory and the vendor advisory.
What to do now
- Check NetworkManager versions on Linux laptops, workstations and kiosks.
- Install your distribution's update that includes the upstream fix (1.58.1 or later, or a backport).
- Until then, move 802.1X profiles from per-user private to system wide, which the Red Hat page suggests.
- Set 802-1x.system-ca-certs to yes on enterprise profiles, so the system CA path overrides a user supplied one.
- Audit existing profiles for CA paths that point into user writable directories.
- Tell users on shared machines not to join enterprise networks from profiles they did not create.
Why it matters
This is CWE-863 (incorrect authorization), an authorization gap. NetworkManager had a rule that private profiles must not carry certain user controlled paths, but it missed two properties that accept directories. That is how a fix for CVE-2025-9615 ended up incomplete.
Why does a CA path matter? Enterprise Wi-Fi relies on the client checking the server certificate. If a user, or malware running as that user, can point the check at a directory they control, a rogue access point can present a certificate the client accepts. The client then hands over credentials. The impact is credential theft, which can reach well beyond the one laptop.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does the flaw need physical presence near the Wi-Fi network?
The local part is the user on the machine. A rogue access point is how credentials would be captured after certificate validation is weakened, according to the CVE text.
What is the quickest mitigation?
Red Hat's page suggests system wide 802.1X profiles and setting 802-1x.system-ca-certs to yes, until you install the fixed package.
Sources
Last reviewed: 18 October 2026.
