EUVD-2026-66237
GHSA-ffp5-8472-58q5
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Alternate path authentication
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 27, 2026
Memory updated with the new marker. The analysis is clean and unmanipulated.
Earlier versions of this analysis (1)
Privilege escalation in FreeBSD 15.x via the mac_do MAC framework module allows local processes operating under applicable transition rules to incorrectly acquire GID 0 (wheel group membership) due to a stale credential structure reference in the group_is_primary() function. Affected versions are FreeBSD 15.0-RELEASE before p13 and FreeBSD 15.1-RELEASE before p3, as confirmed by FreeBSD Security Advisory FreeBSD-SA-26:59. No public exploit code exists and EPSS is 0.14% (3rd percentile), reflecting the narrow, configuration-dependent conditions required for exploitation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Freebsd gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Local execution required with specific mac_do policy in place and typically a prior privileged call, giving AV:L and AC:H; PR:L reflects the attacker must be a specific low-privileged user covered by a rule.
Primary rating from Vendor (freebsd).
CVSS VectorVendor: freebsd
Lifecycle Timeline
4DescriptionCVE.org
In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing the list of supplementary group IDs, whereas now the primary group ID is stored in a dedicated field. This change was largely internal to the kernel and not user-visible.
One function, group_is_primary(), was not properly updated as a part of this transition. This function is used by mac_do to determine the primary group ID of the credential after applying a transition rule, used when the rule target does not explicitly specify a group.
As a result, with certain mac_do rules, it is possible for a credential switch to incorrectly set the primary group ID to the ID stored in the first element of the original credential's supplementary group array.
If the list of supplementary groups is empty, this value will be 0, corresponding to the "wheel" group. For example, a rule such as "uid=1001>uid=1002" can be abused to set the primary group ID to 0 even if the process did not originally belong to group 0.
Certain mac_do rules can be abused to set a process' group ID to 0. Note however, that the rule must apply to the caller in order for the bug to be triggered, e.g., given the ruleset "uid=1001>uid=1002", the user must have user ID 1001 in order to trigger the bug.
Further, logged-in users will in general have a non-empty supplementary group list, in which case the bug can at worst be used to set the credential's first supplementary group ID as its primary group ID. Processes must explicitly remove themselves from all supplementary groups, using the privileged setgroups(2) system call, in order to exploit the bug to set 0 as the primary group ID.
Since membership in group 0 is often used to enable controlled privilege escalation, the bug might be further exploitable to obtain root privileges, depending on the system configuration. For instance, a ruleset such as the following could be exploited by a process running as user 1001 and with an empty supplementary group list: "uid=1001>uid=1002;gid=0>uid=0".
Executive ViewAI
CVE-2026-58092 carries HIGH severity (CVSS 8.1) with no public exploit identified at time of analysis. The technical description provided lacks sufficient product identification and attack vector details to assess specific organizational exposure. Immediate clarification of affected systems and product scope is required before determining impact mitigation.
Within 24 hours: obtain complete CVE details including affected product name, version scope, and attack vector from the original advisory source; inventory systems running the affected product. Within 7 days: restrict network access to affected systems if the attack vector is network-based; implement enhanced monitoring for exploitation attempts; escalate to vendor if patch status changes. Within 30 days: develop compensating controls strategy pending vendor patch availability; prepare vulnerability exception documentation if the product is business-critical and unpatched.
No vendor-released patch identified at time of analysis. Interim mitigations depend on confirmed attack vector: if network-exploitable without authentication, network segmentation and WAF rules may reduce exposure; if authentication required, enforce strong access controls and MFA on affected systems; implement continuous monitoring and alerting for exploitation signatures.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and
The rtsol(8) and rtsold(8) programs do not validate the domain search list options provided in router advertisement mess
Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due
The RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before 9.8.5-P2, 9.8.6b1, 9.9.x before 9.9.3-P2, and
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
An issue was discovered in OpenSSH 7.9. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
The vm_map_lookup function in sys/vm/vm_map.c in the mmap implementation in the kernel in FreeBSD 9.0 through 9.1-RELEAS
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated med
Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.3, as used
The Stream Control Transmission Protocol (SCTP) module in FreeBSD 9.3 before p33, 10.1 before p26, and 10.2 before p9, w
In FreeBSD 12.1-STABLE before r359565, 12.1-RELEASE before p7, 11.4-STABLE before r362975, 11.4-RELEASE before p1, and 1
Exploit-DB