# Fedora 45 to obsolete unmaintained NetworkManager VPN plugins vpnc and fortisslvpn

> **Key takeaway:** Fedora Linux 45 will automatically remove the unmaintained NetworkManager-vpnc and NetworkManager-fortisslvpn packages due to local privilege escalation vulnerabilities and lack of upstream maintenance, requiring users to migrate to NetworkManager-libreswan or NetworkManager-openconnect.

**Published:** 2026-11-03T14:00:00+00:00 
**Source:** Fedora Magazine 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/fedora-45-to-obsolete-unmaintained-networkmanager-vpn-plugin.html 

## Summary
The Fedora Engineering and Steering Committee (FESCo) and NetworkManager maintainers have approved the retirement of two legacy VPN plugins, NetworkManager-vpnc and NetworkManager-fortisslvpn, with obsolescence taking effect in Fedora Linux 45. Both plugins are unmaintained upstream and contain published security issues that enable local privilege escalation through malicious VPN profiles and legacy privilege-handling bugs in helper scripts. Fedora 43 and 44 will retain the packages without further updates to prevent abrupt breakage, while Fedora 45 upgrades will automatically remove them if installed.

Users of Cisco IPsec (IKEv1) connections must migrate to NetworkManager-libreswan, which requires enabling the deprecated IKEv1 protocol via /etc/ipsec.d/ikev1.conf and ensuring ipsec.service is running. Fortinet SSLVPN users must switch to NetworkManager-openconnect, which natively supports the older PPP-based Fortinet protocols. The Fedora Magazine article provides detailed migration steps including package installation, connection reconfiguration, and manual tuning of IKE/ESP proposals and routing settings.

## Migration requirements and security rationale
- **Security vulnerabilities:** Both plugins contain published local privilege escalation (LPE) flaws exploitable through malicious VPN profiles and legacy privilege-handling bugs in older VPN helper scripts, with no upstream patches forthcoming.
- **vpnc replacement:** NetworkManager-vpnc users must install NetworkManager-libreswan, create /etc/ipsec.d/ikev1.conf with `ikev1-policy=accept` to enable deprecated IKEv1, ensure ipsec.service is running, and manually reconstruct connection parameters including group names in square brackets and pre-shared keys.
- **fortisslvpn replacement:** NetworkManager-fortisslvpn users must install NetworkManager-openconnect and select "Fortinet SSL VPN" from the protocol dropdown in the Multi-protocol VPN client connection type.
- **Upgrade behavior:** Fedora 43-44 preserve installed packages but receive no security or feature updates; Fedora 45+ automatically removes both packages during system upgrade.
- **Manual configuration tuning:** Libreswan migrations may require adjusting IKE/ESP proposals, Diffie-Hellman/PFS settings, and routing requirements based on gateway configuration and old vpnc logs.

## Why it matters
This retirement demonstrates Fedora's proactive security maintenance model for enterprise connectivity components, but creates mandatory migration work for system administrators managing legacy Cisco and Fortinet VPN deployments. The change also signals broader ecosystem pressure on distributions to drop unmaintained VPN helper scripts that have become liability vectors, potentially accelerating similar removals in RHEL-derived and other enterprise Linux distributions that track Fedora's NetworkManager packaging decisions.