CVE-2026-54411Disclosure

LOWCVSS 6.9 · MEDIUM

Exploitation ongoing with high activity in latest observed window (2 mentions)

Immediate actions

Prioritize remediation for affected systems immediately
Assume compromise if assets are exposed
Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.

Back to dashboard

3.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-208

Priority

LOW

Exploitation

ACTIVE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

Active exploitation appears in 1 classified signals
4 mentions across 2 observed days
Momentum state: stable

What's happening

Active exploitation reported across 1 signal
Technical details provided in 3 signals
Disclosure: 3 classified signals
Peaked 1d ago at 2 mentions (2026-06-14); latest day: 2
4 total mentions across 2 days

Deep dive

Activity timeline4 mentions / 2d

Signal classification2 categories

Disclosure

375.0%

Active Exploitation

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-14	2	Disclosure2
2026-06-15	2	Active Exploitation1Disclosure1

Full discourse4 posts

Omair 🇵🇸@w3bd3vil137d
Disclosure
CVE-2026-54411 in Linux-PAM is a pretty cool timing attack, although not default. https://nvd.nist.gov/vuln/detail/CVE-2026-54411
Post summary
The tweet announces CVE-2026-54411 as a timing attack in Linux‑PAM, but offers no PoC, exploitation tools, active use, or patch info.
00031441
7.2K followersView on X
VulDB 🛡@vuldb136d
Active Exploitation
Our CTI team identified a lot of activities targeting Linux-PAM (CVE-2026-54411) https://vuldb.com/vuln/370870/cti
Post summary
CTI analysts report multiple attacks targeting Linux-PAM CVE-2026-54411, indicating active exploitation in the wild despite no PoC, patch, or detailed technical data being disclosed.
0000052
2.2K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds137d
Disclosure
CVE-2026-54411 Timing Side-Channel Password Recovery in Linux-PAM pam_userdb Module https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-54411
Post summary
The entry announces a timing side‑channel vulnerability in the Linux‑PAM pam_userdb module but provides no proof‑of‑concept, exploit details, or mitigation information.
0000066
4.0K followersView on X
CVE@CVEnew137d
Disclosure
CVE-2026-54411 Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_us… https://www.cve.org/CVERecord?id=CVE-2026-54411
Post summary
The snippet announces CVE-2026-54411, detailing a timing‑based flaw (CWE‑208) in Linux‑PAM’s pam_userdb plaintext password comparison. No PoC, exploit, patch, or active exploitation is cited.
00000180
57.6K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-54411

Omair 🇵🇸@w3bd3vilDisclosure

The tweet announces CVE-2026-54411 as a timing attack in Linux‑PAM, but offers no PoC, exploitation tools, active use, or patch info.

VulDB 🛡@vuldbActive Exploitation

CTI analysts report multiple attacks targeting Linux-PAM CVE-2026-54411, indicating active exploitation in the wild despite no PoC, patch, or detailed technical data being disclosed.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The entry announces a timing side‑channel vulnerability in the Linux‑PAM pam_userdb module but provides no proof‑of‑concept, exploit details, or mitigation information.

CVE@CVEnewDisclosure

The snippet announces CVE-2026-54411, detailing a timing‑based flaw (CWE‑208) in Linux‑PAM’s pam_userdb plaintext password comparison. No PoC, exploit, patch, or active exploitation is cited.