Hackers are exploiting a decade-old, critical security vulnerability affecting hundreds of thousands of internet-exposed Telnet servers.
CVE-2026-24061 is a critical (CVSS V3 9.8) authentication bypass vulnerability in the GNU InetUtils telnetd server, which, when exploited, could grant threat actors complete control of the device.
Shortly after the proof-of-concept (PoC) code was released, attackers actively began exploiting the vulnerability and attempted to install Python malware.
Decade-old critical security vulnerability affects all Telnet servers
The critical security vulnerability in GNU InetUtils telnetd affects versions 1.9.3 to 2.7 released since May 2015. It was uncovered when an open-source contributor warned that a forgotten bug could grant attackers root privileges.
According to the maintainer, a hacker can exploit CVE-2026-24061 by sending a specially crafted USER environment variable as ‘-f root’ to log in automatically. The tactic works because telnetd does not sanitize the variable before passing it to login(1), which uses the ‘-f’ parameter to bypass normal authentication.
“The telnetd server invokes /usr/bin/login (normally running as root) passing the value of the USER environment variable received from the client as the last parameter,” Simon Josefsson wrote.
Federico Simonetti, CTO of Xiid, said the decade-old security vulnerability highlights the growing operational risk of organizations relying on legacy systems for convenience.
“Even as attackers adopt AI, they haven’t abandoned simple tactics, such as exploiting authentication bypass flaws in protocols like Telnet,” he noted. “The answer isn’t just to patch. It’s to eliminate exposure altogether by using drop-in, post-quantum secure, process-to-process tunnels that create isolated, protected paths for every connection. If attackers can’t see the target, they can’t attack it. True cybersecurity starts by making systems unreachable, not just harder to break into.”
Over 800,000 Telnet servers affected by CVE-2026-24061
According to the Shadowserver Foundation, the security vulnerability affects at least 800,000 internet-exposed Telnet servers, putting them at risk of active exploitation.
Most of the vulnerable Telnet servers are located in Asia and South America, with China leading with 130,000 instances and Brazil closely following with 119,000 exposed IP addresses. Other heavily impacted countries include the United States (50,000), Japan (41,000), Mexico (30,000), and India (27,000).
However, the actual number of impacted Telnet servers may be higher than reported, as Shadowserver could not safely check some IP addresses.
Telnet security vulnerability CVE-2026-24061 exploited in the wild
According to threat intelligence firm GreyNoise, threat actors began exploiting CVE-2026-24061 shortly after the proof-of-concept code was released.
The firm observed attackers attempting to inject the USER environment variable into Telnet connections, targeting the root user in most cases. Over 18 IP addresses executed 60 exploitation attempts, with all traffic to the Telnet protocol being entirely malicious.
They also unsuccessfully attempted to deploy Python malware to gain persistence. GreyNoise characterized the activity as typical of “botnet operators and state-sponsored actors.”
Subsequently, the flaw could be exploited by state-sponsored threat actors to compromise their adversaries’ critical infrastructure.
Similarly, Tyler Hudak of Inversion6 reported that one of their honeypots was compromised within 60 minutes, with threat actors logging in as root, executing commands, installing backdoors, and scanning for other targets.
Hudak suggested that while corporate Telnet servers may be secured, threat actors could exploit employees’ personal devices and pivot to corporate infrastructure.
“This exploit further reinforces the challenges enterprises face in keeping pace with attacker speed rather than attacker sophistication,” said Mayank Kumar, Founding AI Engineer at DeepTempo. “Exploitation began one day after the vulnerability was patched, which signals that adversaries weren’t reacting to disclosure, they were already prepared to operationalize this exact class of vulnerability. It is very important to note how quickly an attacker can validate, weaponize, and move deeper into infrastructure. With AI and AI agents, this speed will increase even further.”
Meanwhile, the maintenance team has released telnetd version 2.8, which blocks the exploitation of CVE-2026-24061. They also released standalone patches that could be applied to independently embedded Telnet servers.
However, legacy operational technology (OT) and Internet of Things (IoT) devices usually embed telnetd, making the threat particularly concerning because many are no longer actively maintained or patched. Similarly, shadow IoT devices pose a significant risk because most organizations may not be aware of their existence.
Consequently, the team recommends retiring Telnet servers, restricting network access to trusted clients, applying the recently released patches, or upgrading to newer systems. Organizations could also use a custom script that disallows the use of the ‘-f’ parameter during login to prevent exploitation of the critical security vulnerability.
