CVE-2026-4948
Firewalld ≤ 2.4.0
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NSummary
CVE-2026-4948 is a medium-severity Incorrect Execution-Assigned Permissions (CWE-279) vulnerability in Firewalld Firewalld. Its CVSS base score is 5.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique File and Directory Permissions Modification (T1222); ranked at the 2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-16557
Vulnerability Data
A flaw was found in firewalld. A local unprivileged user can exploit this vulnerability by mis-authorizing two runtime D-Bus (Desktop Bus) setters, setZoneSettings2 and setPolicySettings. This mis-authorization allows the user to modify the runtime firewall state without proper authentication, leading…
more
to unauthorized changes in network security configurations.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 2 hardening rules · 1 OS baseline
—
Mitigating Controls (NIST 800-53 r5) AI
Enforcing approved authorizations structurally stops the runtime assignment of permissions that violate user intent.
Requiring least privilege limits the permissions the executing code is allowed to assign.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Restricting privileged utility programs reduces the chance that such tools will incorrectly alter object permissions.
Privileged access rights management directly constrains the permissions a process may assign at runtime.
Secure coding practices can prevent the coding error that leads to incorrect permission assignment.
Information access restriction policies limit the permissions that executing code can grant or modify.
Change-management procedures can catch permission-setting mistakes before they reach production.