What is the CVSS score of CVE-2026-15226?

CVE-2026-15226 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of snapd are affected by CVE-2026-15226?

A sandbox escape vulnerability in Canonical snapd affects all Ubuntu LTS releases (16.04-26.04), allowing compromised snap applications to bypass confinement and execute arbitrary code with elevated…. A patch is available.

How to fix or mitigate CVE-2026-15226?

Within 24 hours: Identify and inventory all snap packages installed across Ubuntu LTS systems (16.04, 18.04, 20.04, 22.04, 24.04, 26.04) and classify by trust level and network exposure. Within 7 days: Remove non-essential snaps and apply the most restrictive confinement profiles available for critical snaps; prioritize removal of any snaps processing untrusted user input or accepting network connections. Within 30 days: Monitor Canonical security announcements for seccomp template patches; prepare test environments and deploy patches to snap-confine immediately upon vendor release, beginning with LTS releases 26.04 and 24.04, then progressing to 22.04, 20.04, 18.04, and 16.04.

snapd CVE-2026-15226

EUVD-2026-46261 HIGH

Execution with Unnecessary Privileges (CWE-250)

2026-07-21 canonical

GHSA-9pj8-7m3m-mh5h

Privilege Escalation Canonical Ubuntu 20 04 Lts Ubuntu 22 04 Lts Ubuntu 24 04 Lts Ubuntu 26 04 Lts Ubuntu 18 04 Lts Ubuntu 16 04 Lts

8.4

CVSS 3.1 · Vendor: canonical

Severity by source

Vendor (canonical) PRIMARY

8.4 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

8.4 HIGH

Attacker needs local code execution inside a confined snap (AV:L/PR:L), the bypass is straightforward (AC:L), and escaping confinement crosses a trust boundary (S:C) with high confidentiality/integrity impact and no availability effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (canonical).

CVSS VectorVendor: canonical

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 15:00 vuln.today

CVE Published

Jul 21, 2026 - 14:02 cve.org

HIGH 8.4

DescriptionCVE.org

A sandbox confinement bypass vulnerability exists in Canonical snapd within its internal execution environment compiler (snap-confine). The default seccomp security templates generated by the engine to restrict system calls do not filter or reject process operations capable of creating or manipulating file execution flags with set-user-ID attributes. Consequently, an application running within a strictly confined snap environment can successfully compile or drop binaries and apply setuid properties to them. If a compromised or malicious process inside the snap sandbox executes these generated setuid binaries, it can potentially circumvent architectural sandboxing assumptions, drop intended restriction policies, or execute privileged actions inside the container namespace that should otherwise be strictly blocked. The vulnerability has been resolved by hardening the seccomp template engine to block the execution and creation of setuid executables by sandboxed snap processes.

AnalysisAI

Sandbox confinement bypass in Canonical snapd (snap-confine) affects all supported Ubuntu LTS releases (16.04 through 26.04) because the default seccomp templates fail to block system calls that create or set set-user-ID flags on files. A process already running inside a strictly confined snap can compile or drop a binary, mark it setuid, and then execute it to escape confinement assumptions and perform privileged actions within the container namespace. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the CVSS 8.4 (scope-changed) rating reflects a genuine confinement-escape primitive.

Technical ContextAI

snapd confines applications using a layered sandbox in which snap-confine sets up a mount namespace, AppArmor profiles, and a seccomp-bpf system-call filter generated from default templates. The vulnerability is a CWE-250 (Execution with Unnecessary Privileges) weakness: the generated seccomp template does not deny the syscalls used to set the S_ISUID mode bit (e.g. chmod/fchmod/fchmodat with setuid flags) on files a confined snap can write. Because setuid binaries carry their owner's privileges on execution, allowing a confined process to author and mark such a binary undermines the seccomp/namespace model that is supposed to strip elevated behavior. The CPE data scopes impact to the Canonical Ubuntu LTS platform packages (Ubuntu 16.04, 18.04, 20.04, 22.04, 24.04, and 26.04 LTS), all of which ship snapd by default.

RemediationAI

Patch available per vendor advisory: Canonical has resolved the issue by hardening the seccomp template engine to block creation and execution of setuid executables by sandboxed snap processes - apply the updated snapd package for your release via the standard channel (e.g. 'sudo snap refresh snapd' and 'sudo apt update && sudo apt install --only-upgrade snapd'), then confirm the fixed version against https://ubuntu.com/security/CVE-2026-15226 as exact fixed version numbers were not included in the input. Because exploitation requires a malicious process already inside a confined snap, interim compensating controls include auditing and restricting which untrusted snaps are installed, removing or tightening snaps from unverified publishers, and monitoring for confined processes creating setuid binaries; note these controls reduce but do not eliminate the flaw and may disrupt legitimate snaps that manage their own binaries. No independently confirmed fixed version number is available from the provided data, so verify before asserting compliance.