RCE in tac_plus, common TACACS+
implementation. And perhaps underneath a number of commercial solutions that provide network authentication. Pre-auth vuln. No CVE yet. Goes back 25 years. "Shrubbery fixed it in F4.0.4.32, published on 21 September, and the Facebook fork is archived, so it will not be fixed at all."
https://www.elttam.com/blog/att-cking-tacacs-to-pwnyour-network-via-a-pre-auth-rce
Royce Williams
npub1d9…v7m3z
2026-09-23 13:12:25 UTC
Author Public Key
npub1d9j86kugzarj4skw6juglk2de6mful9svqu8yac6vum5wz5xtcwsyv7m3zSeen on
wss://relay.momostr.pinkPublished at
2026-09-23 13:12:25 UTCEvent JSON
{
"id": "f05c23e5cc8926209b409b5304b17d75015c1c493abe6800694099a239cce618",
"pubkey": "69647d5b8817472ac2ced4b88fd94dceb69e7cb0603872771a6737470a865e1d",
"created_at": 1790169145,
"kind": 1,
"tags": [
[
"proxy",
"https://infosec.exchange/@tychotithonus/117320525142214607",
"web"
],
[
"proxy",
"https://infosec.exchange/users/tychotithonus/statuses/117320525142214607",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/tychotithonus/statuses/117320525142214607",
"pink.momostr"
],
[
"-"
]
],
"content": "RCE in tac_plus, common TACACS+\nimplementation. And perhaps underneath a number of commercial solutions that provide network authentication. Pre-auth vuln. No CVE yet. Goes back 25 years. \"Shrubbery fixed it in F4.0.4.32, published on 21 September, and the Facebook fork is archived, so it will not be fixed at all.\"\nhttps://www.elttam.com/blog/att-cking-tacacs-to-pwnyour-network-via-a-pre-auth-rce",
"sig": "2f9bb649cfe3d878230aa15abdb26820a7cd957d85aeef7b8e0941a9db70222653accb9bab5f5b850eb90d47fd31be6f96fc6f982d9e33351f1a820fb2a7a3fb"
}