Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 7.8, CVEs: CVE-2026-61898, CVE-2026-61897, Summary: CVE-2026-61898 7.8 accountsservice: shell injection via attacker-controlled ~/.pam_environment in Ubuntu language helper scripts CVE-2026-61897 7.8 accountsservice: incomplete privilege drop when running Ubuntu-specific language helper scripts See also: https://ubuntu.com/security/CVE-2026-61898