CVE-2026-43503 DirtyClone: IPsec tunnel creation by unprivileged user

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•6

Detects the configuration of network tunnels or IPsec-related settings using tools such as ip, setkey, racoon, or strongswan by a non-root user. This behavior is indicative of potential unauthorized tunnel establishment or lateral movement activities where a standard user attempts to bypass network controls.