The NetworkManager-fortisslvpn plugin (FortiSSLVPN plugin for NetworkManager) contains a flaw where the nm-fortisslvpn-service improperly neutralizes carriage-return/line-feed (CRLF) sequences in VPN connection profile credentials. This allows a local unprivileged user to craft a malicious VPN profile that injects additional configuration directives. Activation of the crafted VPN connection can result in arbitrary code execution with root privileges. Red Hat's advisory confirms no currently supported Red Hat product is affected. The vulnerability is tracked as CVE-2026-91839 with a CVSS 3.1 score of 7.8 (high severity).

Successful exploitation allows a local unprivileged user to escalate privileges to root by injecting configuration directives via CRLF injection in VPN profile credentials, leading to arbitrary code execution with full system privileges.

Red Hat advises that if the NetworkManager-fortisslvpn plugin is not required, the package should be removed to eliminate the attack vector using the command: sudo dnf remove NetworkManager-fortisslvpn. This may impact systems relying on FortiSSLVPN connectivity, and a system restart may be necessary. No official patch or fix is currently indicated, and Red Hat states no supported products are affected.