diff --git a/SPECS/munge/munge.signatures.json b/SPECS/munge/munge.signatures.json
index f42a914f464..eb8b3e96ba5 100644
--- a/SPECS/munge/munge.signatures.json
+++ b/SPECS/munge/munge.signatures.json
@@ -1,7 +1,7 @@
 {
- "Signatures": {
-  "create-munge-key": "faf294f275027c9165524daa17e862ae7e28cb32aed5f9c452d9bd37065ccebe",
-  "munge-0.5.13.tar.xz": "99753dfd06a4f063c36f3fb0eb1964f394feb649937d94c4734d85b7964144da",
-  "munge.logrotate": "f8443edd07c98e0e3c9178c93a0a35e1c690cf3b6fbdb33508b34871657a9879"
- }
-}
\ No newline at end of file
+  "Signatures": {
+    "create-munge-key": "faf294f275027c9165524daa17e862ae7e28cb32aed5f9c452d9bd37065ccebe",
+    "munge.logrotate": "f8443edd07c98e0e3c9178c93a0a35e1c690cf3b6fbdb33508b34871657a9879",
+    "munge-0.5.18.tar.xz": "39c3ec6ef5604bfa206e8aa10fc05d5119040f6de4a554bc0fb98ca1aed838dc"
+  }
+}
diff --git a/SPECS/munge/munge.spec b/SPECS/munge/munge.spec
index 53f4e2ef2de..dab5d26007f 100644
--- a/SPECS/munge/munge.spec
+++ b/SPECS/munge/munge.spec
@@ -1,7 +1,7 @@
 Summary:        Enables uid & gid authentication across a host cluster
 Name:           munge
-Version:        0.5.13
-Release:        9%{?dist}
+Version:        0.5.18
+Release:        1%{?dist}
 # The libs and devel package is GPLv3+ and LGPLv3+ where as the main package is GPLv3 only.
 License:        GPLv3+ AND LGPLv3+
 Vendor:         Microsoft Corporation
@@ -53,7 +53,6 @@ cp -p %{SOURCE2} munge.logrotate
 
 %build
 %configure  --disable-static --with-crypto-lib=openssl
-echo "d /run/munge 0755 munge munge -" > src/etc/munge.tmpfiles.conf.in
 # Get rid of some rpaths for /usr/sbin
 sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool
 sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool
@@ -123,7 +122,6 @@ exit 0
 %attr(0755,munge,munge) %dir /run/munge/
 %attr(0644,munge,munge) %ghost /run/munge/munged.pid
 
-%config(noreplace) %{_tmpfilesdir}/munge.conf
 %config(noreplace) %{_sysconfdir}/logrotate.d/munge
 
 %license COPYING COPYING.LESSER
@@ -156,6 +154,9 @@ exit 0
 %{_mandir}/man3/munge_strerror.3.gz
 
 %changelog
+* Fri Feb 13 2026 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 0.5.18-1
+- Auto-upgrade to 0.5.18 - for CVE-2026-25506
+
 * Mon Feb 06 2023 Riken Maharjan <rmaharjan@microsoft.com> - 0.5.13-9
 - Move from Extended to Core.
 - License verified.
diff --git a/cgmanifest.json b/cgmanifest.json
index e7755f2e4e4..6d3b7610192 100644
--- a/cgmanifest.json
+++ b/cgmanifest.json
@@ -13773,8 +13773,8 @@
         "type": "other",
         "other": {
           "name": "munge",
-          "version": "0.5.13",
-          "downloadUrl": "https://github.com/dun/munge/releases/download/munge-0.5.13/munge-0.5.13.tar.xz"
+          "version": "0.5.18",
+          "downloadUrl": "https://github.com/dun/munge/releases/download/munge-0.5.18/munge-0.5.18.tar.xz"
         }
       }
     },