PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-75037 ilya-zlobintsev CVE debrief

The CVE-2026-75037 authentication bypass vulnerability affects LACT on Linux, allowing attackers to bypass authentication mechanisms. This issue, fixed in version 0.10.0, has a high CVSS score of 7.3, indicating significant risk. Linux system administrators and users of LACT versions prior to 0.10.0 should review and apply patches or upgrades to mitigate this vulnerability. The evidence provided is limited; primary official records indicate an authentication bypass vulnerability in LACT on Linux, fixed by commit d0478fe42c2219454e272f96b1cbd29ab37ee566. Further verification is needed to assess the full scope of affected systems and potential impact. Defenders should verify LACT versions, review system inventory, and monitor logs for suspicious activity.

Vendor
ilya-zlobintsev
Product
LACT
CVSS
HIGH 7.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-25
Original CVE updated
2026-09-01
Advisory published
2026-08-25
Advisory updated
2026-09-01

Who should care

Linux system administrators and users of LACT versions prior to 0.10.0 should review and apply patches or upgrades to mitigate the authentication bypass vulnerability. Additionally, security teams and vulnerability management teams should assess the potential impact on their systems and prioritize patching accordingly. Operators of affected systems should also review compensating controls and monitor system logs for potential exploitation attempts.

Technical summary

The Polkit Authentication Based on UnixProcessSubject / Peer PID in LACT on Linux allows an Authentication Bypass. This issue affects LACT through version 0.10.0 and was fixed by commit d0478fe42c2219454e272f96b1cbd29ab37ee566. The vulnerability has a high CVSS score of 7.3, indicating a high severity level. Affected systems include LACT versions prior to 0.10.0. Security teams should assess the potential impact on their systems and prioritize patching accordingly.

Defensive priority

High-priority defensive review recommended due to high CVSS score of 7.3.

Recommended defensive actions

  • Verify LACT version is prior to 0.10.0 and apply patch or upgrade to fixed version
  • Review system inventory for LACT installations
  • Monitor system logs for suspicious activity

Evidence notes

The evidence provided is limited; primary official records indicate an authentication bypass vulnerability in LACT on Linux, fixed by commit d0478fe42c2219454e272f96b1cbd29ab37ee566. Further verification is needed to assess the full scope of affected systems and potential impact. Defenders should verify LACT versions, review system inventory, and monitor logs for suspicious activity.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-75037 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-75037

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-75037 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-75037

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.