Skip to main content

Sudo CVE-2026-82474

| EUVDEUVD-2026-68130 HIGH
Protection Mechanism Failure (CWE-693)
2026-08-29 VulnCheck GHSA-36m7-65w5-jm6c
Authentication Bypass Red Hat Sudo Sudo Project
8.5
CVSS 4.0 · Vendor: VulnCheck
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain local account with any sudo rule
  2. Delivery
    Confirm intercept option active in sudoers
  3. Exploit
    Open file descriptor to forbidden target binary
  4. Execution
    Call fexecve or direct execveat syscall
  5. Persist
    Sudo ptrace handler skips policy check for execveat
  6. Impact
    Execute arbitrary binary within sudo-level context with no audit trail

Vulnerability Assessment

Weakness
CWE
CWE-693
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Protection mechanism completeness
Exploitation Conditions

Three conditions must all be simultaneously present: (1) Sudo version 1.9.x through 1.9.17p2 compiled with Linux ptrace intercept support; (2) the 'intercept' option explicitly configured in sudoers - this is not enabled by default; (3) the attacker holds a local user account with at least one sudo rule granting permission to execute any command, even a tightly scoped one. Default Sudo deployments without the 'intercept' sudoers option are entirely unaffected regardless of version. The CVSS PR:L confirms a low-privileged local account is required; AV:L confirms local system access is required, ruling out remote or unauthenticated exploitation.
Impact

The CVSS 4.0 score of 8.5 (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) accurately reflects a local, low-complexity attack requiring only a low-privileged account with at least one existing sudo rule. No EPSS score is included in the provided intelligence, and no CISA KEV listing or POC report is present, placing this in the disclosure-to-patch-window risk category rather than an active exploitation emergency. The decisive limiting factor is that Sudo's ptrace intercept mode is a non-default configuration: organizations that do not use the 'intercept' sudoers option are not exposed regardless of their Sudo version, substantially narrowing the real-world affected population. Environments that do use intercept mode should treat this as high priority, since once the conditions apply the attack requires no elevated skills - AC:L and AT:N mean any informed local user with a sudo rule can exploit this trivially. The CVSS vector is internally consistent with the description and the patch diff; no conflicting signals are present across the available data sources.
Exploit ScenarioDerived

A local user permitted to run only /usr/bin/vim via sudo opens a file descriptor to /bin/bash, then calls fexecve (which internally issues execveat with AT_EMPTY_PATH), bypassing the sudo intercept layer completely. Because execveat is not inspected by the ptrace handler, the shell launches within the sudo execution context and no policy violation is recorded in the audit log. No public proof-of-concept has been identified at time of analysis, but the technique requires only standard POSIX API calls available in any C program or scripting language with foreign-function interface support.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 29, 2026

Privilege escalation in Sudo through 1.9.17p2 allows any local user holding a sudo rule to execute arbitrary commands when ptrace-based intercept mode is enabled. The intercept layer in exec_ptrace.c monitored only execve(2) system calls, leaving execveat(2) - and the fexecve libc wrapper built atop it - entirely uninspected, bypassing both policy enforcement and audit logging. No public exploit has been identified at time of analysis; the upstream fix is available as a confirmed commit to the sudo-project repository.

RemediationAI

The upstream fix is confirmed at commit 71fbe42dcd5a1c8f799540583a2dfb2ae6221edf (https://github.com/sudo-project/sudo/commit/71fbe42dcd5a1c8f799540583a2dfb2ae6221edf); administrators should apply distribution-packaged updates as soon as a tagged release incorporating this commit is available, as no specific patched version number was confirmed in the provided data. As an immediate compensating control, remove or disable the 'intercept' option from the sudoers configuration if ptrace-based enforcement is not operationally required - this eliminates the vulnerable code path entirely with no impact on standard sudo command allow/deny rules or conventional logging. Note that disabling 'intercept' removes the protection that option was intended to provide, so environments relying on ptrace interception as a security boundary must prioritize patching rather than applying this workaround.

Affected VersionsENISA

sudo 0 ≤1.9.17p2

Affected Packages

euvd sudo no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Sudo's ptrace intercept mode (activated via the 'intercept' sudoers option) uses the Linux ptrace facility to trap outbound system calls from supervised processes and validate them against policy before permitting execution. The vulnerable code resided in src/exec_ptrace.c, whose get_execve_info function handled only the three-argument execve(2) syscall (pathname, argv, envp). The execveat(2) syscall - a Linux 3.19+ extension taking five arguments (dirfd, pathname, argv, envp, flags) - was not intercepted, creating a complete blind spot. The fexecve(3) libc function internally calls execveat with AT_EMPTY_PATH and a file descriptor, making this bypass accessible without custom syscall code. The fix renames get_execve_info to get_exec_info and adds an is_execveat parameter, properly reading all five execveat arguments via new get_sc_arg4/get_sc_arg5 helpers. CPE cpe:2.3:a:sudo-project:sudo:*:*:*:*:*:*:*:* covers all affected versions through 1.9.17p2. CWE-693 (Protection Mechanism Failure) is the root cause: the security mechanism was implemented but incompletely, failing to cover the full relevant syscall surface.

Know when Sudo gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulnCheck) PRIMARY 8.5 HIGH
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
vuln.today AI 7.8 HIGH

Local access with any existing sudo rule is sufficient; once intercept mode is configured by the administrator, no additional attacker complexity or privileges beyond PR:L are required.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat 7.8 HIGH

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Local
Attack Complexity
Low
Attack Requirements
None
Privileges Required
Low
User Interaction
None
Vulnerable system: Confidentiality
High
Vulnerable system: Integrity
High
Vulnerable system: Availability
High
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

DescriptionCVE.org

Sudo through 1.9.17p2 fails to apply intercept policy checks to the execveat system call in ptrace-based intercept mode. Users permitted to run specific commands can execute denied programs by calling execveat directly or through fexecve, bypassing policy enforcement and logging.

Executive ViewAI

Why It Matters

Sudo, a critical access control tool across Linux/Unix environments, contains a privilege escalation flaw that allows users to bypass policy enforcement and erase audit trails. This exposes organizations to unauthorized command execution and regulatory compliance violations. Immediate patching is required to restore security controls.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.1%
Top 97% exploitable
Prevalence
High
Sudo is default-installed on virtually all Linux distributions
Social Media
3
Sightings
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

42
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +42
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

More in Sudo

View all
CVE-2025-32463 CRITICAL POC
9.3 Jun 30

Sudo before 1.9.17p1 contains a local root escalation vulnerability (CVE-2025-32463, CVSS 9.3) through the --chroot opti
CVE-2012-0809 HIGH POC
7.2 Feb 01

Format string vulnerability in the sudo_debug function in Sudo 1.8.0 through 1.8.3p1 allows local users to execute arbit
CVE-2025-32462 HIGH POC
8.8 Jun 30

Incorrect host matching in Sudo before 1.9.17p1 allows local attackers to execute commands on unintended machines when t
CVE-2013-1775 MEDIUM POC
6.9 Mar 05

sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate attackers to bypas
CVE-2023-22809 HIGH POC
7.8 Jan 18

In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
CVE-2021-3156 HIGH POC
7.8 Jan 26

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege
CVE-2017-1000367 MEDIUM POC
6.4 Jun 05

Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_
CVE-2026-35535 HIGH POC
7.8 Apr 03

Local privilege escalation in Sudo through 1.9.17p2 (fixed in commit 3e474c2) arises because a failed setuid, setgid, or
CVE-2019-14287 HIGH POC
8.8 Oct 17

In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and se
CVE-2015-5602 HIGH POC
7.2 Nov 17

sudoedit in Sudo before 1.8.15 allows local users to gain privileges via a symlink attack on a file whose full path is d
CVE-2021-23240 HIGH POC
7.8 Jan 12

selinux_edit_copy_tfiles in sudoedit in Sudo before 1.9.5 allows a local unprivileged user to gain file ownership and es
CVE-2023-27320 HIGH POC
7.2 Feb 28

Sudo before 1.9.13p2 has a double free in the per-command chroot feature. Rated high severity (CVSS 7.2), this vulnerabi

Same weakness CWE-693 – Protection Mechanism Failure

View all
CVE-2013-2465 CRITICAL POC
9.8
CVE-2024-21412 HIGH POC
8.1
CVE-2019-1003030 CRITICAL POC
9.9
CVE-2013-0431 LOW POC
3.7
CVE-2025-40536 HIGH POC
8.1
CVE-2024-38217 MEDIUM POC
5.4
CVE-2026-21513 HIGH
8.8
CVE-2026-21510 HIGH POC
8.8

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected
SLES15-SP6-CHOST-BYOS-EC2 Affected

References

Advisories & patches
PATCH https://github.com/sudo-project/sudo/commit/71fbe42dcd5a1c8f799540583a2dfb2ae6221edf ADVISORY https://access.redhat.com/errata/RHSA-2026:65569 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-82474 ADVISORY https://vuldb.com/vuln/397040 REF https://github.com/sudo-project/sudo REF https://github.com/sudo-project/sudo/blob/v1.9.17p2/src/exec_ptrace.c REF https://www.vulncheck.com/advisories/sudo-through-1.9-17p2-intercept-policy-bypass-via-execveat

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy