What is the CVSS score of CVE-2026-31979?

CVE-2026-31979 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Himmelblau are affected by CVE-2026-31979?

A critical local privilege escalation vulnerability exists in Himmelblau (Azure Entra ID/Intune interoperability) affecting versions prior to 3.1.0 and 2.3.8.. A patch is available.

How to fix or mitigate CVE-2026-31979?

Within 24 hours: Identify all systems running Himmelblau versions 3.0.x and 2.3.x; assess user access to affected hosts and document current deployments. Within 7 days: Upgrade to Himmelblau 3.1.0 or 2.3.8 or later if available; if upgrades unavailable, implement temporary mitigation (see compensating controls). Within 30 days: Complete full inventory validation, validate all systems are patched or mitigated, and conduct access review for local user accounts on Himmelblau hosts.

Himmelblau CVE-2026-31979

HIGH

Improper Link Resolution Before File Access (CWE-59)

2026-03-11 security-advisories@github.com

Privilege Escalation Microsoft Himmelblau Suse

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:07 vuln.today

CVE Published

Mar 11, 2026 - 20:16 nvd

HIGH 8.8

DescriptionGitHub Advisory

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Prior to 3.1.0 and 2.3.8, the himmelblaud-tasks daemon, running as root, writes Kerberos cache files under /tmp/krb5cc_<uid> without symlink protections. Since commit 87a51ee, PrivateTmp is explicitly removed from the tasks daemon's systemd hardening, exposing it to the host /tmp. A local user can exploit this via symlink attacks to chown or overwrite arbitrary files, achieving local privilege escalation. This vulnerability is fixed in 3.1.0 and 2.3.8.

AnalysisAI

Local privilege escalation in Himmelblau prior to versions 3.1.0 and 2.3.8 allows authenticated local users to exploit insecure Kerberos cache file handling in the root-running himmelblaud-tasks daemon through symlink attacks. The vulnerability stems from the removal of PrivateTmp protections, exposing /tmp operations to symlink-based file overwrite and ownership manipulation attacks. An attacker with local access can leverage this flaw to achieve arbitrary file modification and full system compromise.

Technical ContextAI

This vulnerability (CWE-59: Improper Link Resolution Before File Access) affects Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune.. Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Prior to 3.1.0 and 2.3.8, the himmelblaud-tasks daemon, running as root, writes Kerberos cache files under /tmp/krb5cc_<uid> without symlink protections. Since commit 87a51ee, PrivateTmp is explicitly removed from the tasks daemon's systemd hardening, exposing it to the host /tmp. A local user can exploit this via symlink attacks to chown or overwrite arbitrary files, achieving local privilege escalation. This vulne

RemediationAI

Fixed in version 3.1.0.

More in Himmelblau

View all

CVE-2025-54882 HIGH This Month POC

7.1 Aug 07

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Rated high severity (CVSS 7.1), this vu

Same weakness CWE-59 – Improper Link Resolution Before File Access

View all

CVE-2015-1130 HIGH POC

7.8

CVE-2026-41091 HIGH POC

7.8

CVE-2016-6664 HIGH POC

7.0

CVE-2025-60710 HIGH POC

7.8

CVE-2024-57728 HIGH POC

7.2

CVE-2025-21391 HIGH

7.1

CVE-2025-48384 HIGH

8.0

CVE-2024-28189 CRITICAL POC

10.0

Same technique Privilege Escalation

View all

CVE-2025-47812 CRITICAL POC

10.0

CVE-2013-0422 CRITICAL POC

9.8

CVE-2013-0632 CRITICAL POC

9.8

CVE-2017-5689 CRITICAL POC

9.8

CVE-2017-12635 CRITICAL POC

9.8

CVE-2016-10372 CRITICAL POC

9.8

CVE-2014-9583 CRITICAL POC

10.0

CVE-2012-0297 CRITICAL POC

10.0

Vendor StatusVendor

SUSE

Severity: High

Product	Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.86 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.110 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.112 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.100 Image SL-Micro	Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server for SAP applications 16.0	Fixed
openSUSE Leap 16.0	Fixed
openSUSE Tumbleweed	Fixed

CVE-2026-31979 vulnerability details – vuln.today

Back

SUSE Linux Enterprise Server 16.0	Affected
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7	Fixed
SUSE Linux Enterprise Server 15 SP7	Fixed
SUSE Linux Enterprise Server 16.0	Fixed
SUSE Linux Enterprise Server 16.1	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise Server for SAP applications 16.0	Fixed
SUSE Linux Enterprise Server for SAP applications 16.1	Fixed
openSUSE Leap 15.6	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS	Fixed
SUSE Linux Enterprise Server 15 SP5-LTSS	Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP6	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP5	Fixed
SLES-CHOST-BYOS-Azure	Fixed

Himmelblau CVE-2026-31979

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

AnalysisAI

Technical ContextAI

RemediationAI

More in Himmelblau

Same weakness CWE-59 – Improper Link Resolution Before File Access

Same technique Privilege Escalation

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code