VulnSocial

CVE-2026-4105Disclosure

LOWCVSS 6.7 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system.

Back to dashboard
2.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-284

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 7 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 2 signals
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 6 signals
  • Disclosure: 3 classified signals
  • General: 2 classified signals
  • Peaked 3d ago at 4 mentions (2026-03-13); latest day: 1
  • 7 total mentions across 4 days

Deep dive

Activity timeline7 mentions / 4d
01234Mentions · 2026-03-13: 4Mentions · 2026-03-14: 1Mentions · 2026-03-25: 1Mentions · 2026-04-15: 1PoC Mentioned / Linked · 2026-03-14: 1PoC Mentioned / Linked · 2026-04-15: 1Patch / Workaround · 2026-03-25: 1Technical Details · 2026-03-13: 3Technical Details · 2026-03-14: 1Technical Details · 2026-03-25: 1Technical Details · 2026-04-15: 103-1303-1403-2504-15
Signal classification4 categories
Disclosure
342.9%
General
228.6%
PoC
114.3%
Patch
114.3%
Referenced assets7 URLs
Classification over time
DateTotalLabels
2026-03-134
Disclosure3General1
2026-03-141
PoC1
2026-03-251
Patch1
2026-04-151
General1
Full discourse7 posts
  • Ferramentas Linux@Cezar_H_Linux
    General

    Stop chasing CVE dates. Here’s how to detect systemd D-Bus privilege escalation (CVE-2026-4105) on ANY distro – with a one-line test and an automation script. busctl call org.freedesktop.machine1 ... Read more: 👉 https://tinyurl.com/3fefnym8 #Security https://t.co/0r3P2z4aO7

    Post summary

    The post announces a detection approach for the systemd D‑Bus privilege escalation CVE‑2026‑4105, offering a one‑line test and automation script, but does not discuss active exploitation, patches, or false‑positive status.

    0002048
    1.5K followersView on X
  • ThreatCluster@threatcluster
    Patch

    BREAKING: SUSE Linux Micro 6.0 patches critical systemd bugs CVE-2026-4105 and CVE-2026-29111, CVSS up to 7.8, enabling local privilege escalation before update. https://threatcluster.io/cluster/critical-privilege-escalation-vulnerabilities-in-suse-linux--f2f9ba51

    Post summary

    SUSE Linux Micro 6.0 has released patches for systemd bugs CVE-2026-4105 and CVE-2026-29111, addressing local privilege escalation vulnerabilities rated up to CVSS 7.8. No evidence of active exploitation or a PoC is provided.

    0001055
    114 followersView on X
  • Exploit Intel@exploit_intel
    PoC

    CVE-2026-4105 - local root on systemd-machined. Two D-Bus calls, no auth. Fed it to CVEForge, had a working exploit in 72 minutes - then it found a bypass: https://exploit-intel.com/blog/posts/cve-2026-4105-systemd-machined-privilege-escalation/ #CVE20264105

    Post summary

    The post announces a local root vulnerability in systemd-machined, provides a link to a proof‑of‑concept exploit blog, but does not disclose active wild exploitation or a patch.

    0000037
    4 followersView on X
  • VulDB 🛡@vuldb
    General

    We have just added an important vulnerability affecting Red Hat Enterprise Linux (CVE-2026-4105) https://vuldb.com/?id.350835

    Post summary

    The post announces a new CVE-2026-4105 vulnerability impacting Red Enterprise Linux but provides no further technical details, PoC, exploit, or patch information.

    0000080
    2.1K followersView on X
  • CyberDudeBivash® | Global Cybersecurity Company@cyberbivash
    Disclosure

    🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-4105 - Systemd Machined Improper Access Control Vulnerability Intel Report: https://ift.tt/anVwSDK

    Post summary

    Intel has announced the discovery of CVE‑2026‑4105, an improper access control flaw in Systemd Machined, and provided a link to an official advisory, but no PoC, exploit, or patch details are disclosed.

    0000029
    340 followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-4105 A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the… https://www.cve.org/CVERecord?id=CVE-2026-4105 ----- Traducción: Se encontró una f… http://infoflow.cloud`

    Post summary

    The text announces CVE‑2026‑4105, revealing an Improper Access Control flaw in systemd‑machined caused by insufficient validation of the class parameter; no PoC, exploitation, or mitigation information is included.

    0000032
    57 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-4105 A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the… https://www.cve.org/CVERecord?id=CVE-2026-4105

    Post summary

    A new improper access control flaw has been reported in the systemd‑machined service, with details available via the CVE record link.

    00000317
    56.7K followersView on X

Explore more

Back to dashboard