Hackers Exploit CVE-2026-24061 Vulnerability in GNU InetUtils Telnetd

The GNU InetUtils telnetd server has been exposed to a critical-severity vulnerability, CVE-2026-24061, which has existed since 2015. This issue arises from improper handling of the USER environment variable, allowing attackers to connect using the telnet -a command and gain root access without authentication. The vulnerability affects versions 1.9.3 through 2.7, with a patch available in version 2.8, released after the flaw was disclosed on January 20, 2026.

Real-world exploitation of this vulnerability has been observed, with threat monitoring firm GreyNoise reporting activity from 18 unique attacker IPs across 60 Telnet sessions. During these sessions, attackers sent over 1,500 packets, primarily targeting the root user. The attacks utilized the Telnet IAC option negotiation to inject commands that bypass authentication.

Despite the critical nature of the vulnerability, many researchers consider it less urgent due to the limited number of devices exposed on the public internet. However, the presence of telnet on legacy systems, particularly in industrial sectors, means that many devices could still be at risk.

Attackers have attempted to conduct reconnaissance and deploy malware post-exploitation, although these efforts were largely unsuccessful due to missing binaries on the targeted systems. The ongoing exploitation activity indicates that organizations should take immediate steps to secure their systems.

Why This Matters for Your Security

For everyday users and organizations, the CVE-2026-24061 vulnerability highlights the risks associated with using outdated software and legacy protocols like Telnet. Many systems, especially in industrial settings, may still rely on Telnet for compatibility, making them vulnerable to exploitation.

Organizations should prioritize updating their systems to the latest versions of GNU InetUtils or consider disabling the telnetd service entirely. Additionally, blocking TCP port 23 on firewalls can help mitigate risks associated with this vulnerability.

As attackers continue to automate their exploitation techniques, it is crucial for organizations to conduct regular security assessments and monitor for any unauthorized access attempts. Awareness of such vulnerabilities can significantly enhance an organization’s security posture.