Pre-auth format string RCE as root on TCP/49, patched only in Shrubbery F4.0.4.32; Facebook fork unpatched (tac_plus)
The write-up, proof of concept and advisory were published yesterday (2026-09-23), a fix exists for one fork and none for the other, and a compromised TACACS+ server sees administrative credentials for every router, switch and firewall in the estate in near real time. Operators of the Facebook fork have no patch coming and need to migrate or fence the service now.
Researchers at elttam report a remote, pre-authentication format string vulnerability on an error path in tac_plus, the widely deployed open-source TACACS+ daemon descended from Cisco's 1990s reference code. A crafted packet to TCP port 49 yields code execution as the daemon user, which is root by default. The packet must be keyed with the TACACS+ pre-shared key, but the write-up describes a PSK oracle in the server that turns the bug into a practical chain without prior knowledge of the secret, and notes that any network device which forwards externally supplied usernames to the server may let an attacker get a correctly keyed payload through without being on the management network. elttam says Shrubbery Networks fixed it in F4.0.4.32 and that the Facebook fork will not be fixed. A CVE is pending but not yet assigned; no vendor advisory page and no reports of exploitation were found in this material.
Affected: Shrubbery Networks tac_plus releases before F4.0.4.32 (fixed in F4.0.4.32); all versions of the Facebook/Meta tac_plus fork (no fix planned). Exact first-affected release not stated — the researchers say the code path is 25+ years old and descends from the original Cisco reference daemon.
How to Test
Check whether you run tac_plus: look for a tac_plus/tacacs process listening on TCP/49 (ss -lntp | grep :49), and run tac_plus -v to get the version — anything below F4.0.4.32 on the Shrubbery line, or any build of the Facebook fork, is affected per the report. Check whether TCP/49 is reachable from anything other than your network devices' management addresses. Review which devices are TACACS+ clients and whether any accept logins (SSH, web, console server) from the corporate LAN or internet, since those can relay a payload to the server. Indicators given in the report are limited to the bug being on an error path, so look for unusual malformed-packet or parse errors in the tac_plus log and for unexpected child processes of the daemon.
How to Patch
Shrubbery tac_plus: upgrade to F4.0.4.32 from shrubbery.net. Facebook fork: no fix is planned — migrate to Shrubbery F4.0.4.32 or to a maintained TACACS+ server, or at minimum firewall TCP/49 to the explicit list of device management IPs. After upgrading, rotate the shared secret on the server and all clients and, where devices support it, move to TACACS+ over TLS (RFC 9887).