As cited
Copy frozen at (site build).
vulnerabilities
A 32-Year-Old Bug Walks Into A Telnet Server (GNU inetutils Telnetd CVE-2026-32746 Pre-Auth RCE)
A 32-year-old pre-authentication remote code execution vulnerability (CVE-2026-32746) was discovered in GNU inetutils Telnetd by the DREAM Security Research Team. The BSS-based buffer overflow exists in the LINEMODE SLC negotiation handler and affects multiple operating systems and distributions that derive from the same codebase, including Ubuntu, Debian, FreeBSD, NetBSD, and others. Despite the severity and wide impact, the vulnerability had received minimal public analysis at the time of reporting.
Why it matters: Organizations running Telnet on production systems, industrial control devices, or legacy infrastructure are at immediate risk of pre-authentication compromise. Practitioners should audit systems for Telnet services and prioritize patching or disabling the service, as the vulnerability requires no authentication and affects dozens of distributions.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
A 32-Year-Old Bug Walks Into A Telnet Server (GNU inetutils Telnetd CVE-2026-32746 Pre-Auth RCE)
A 32-year-old pre-authentication remote code execution vulnerability (CVE-2026-32746) was discovered in GNU inetutils Telnetd by the DREAM Security Research Team. The BSS-based buffer overflow exists in the LINEMODE SLC negotiation handler and affects multiple operating systems and distributions that derive from the same codebase, including Ubuntu, Debian, FreeBSD, NetBSD, and others. Despite the severity and wide impact, the vulnerability had received minimal public analysis at the time of reporting.
Why it matters: Organizations running Telnet on production systems, industrial control devices, or legacy infrastructure are at immediate risk of pre-authentication compromise. Practitioners should audit systems for Telnet services and prioritize patching or disabling the service, as the vulnerability requires no authentication and affects dozens of distributions.
- Source published
- First seen by Cybersecurity Tracker