What is the CVSS score of CVE-2026-8933?

CVE-2026-8933 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of snap-confine are affected by CVE-2026-8933?

CVE-2026-8933 is a local privilege escalation vulnerability in Ubuntu's snap-confine affecting Ubuntu 22.04, 24.04, and 26.04 LTS systems deployed with snap applications.. A patch is available.

How to fix or mitigate CVE-2026-8933?

Within 24 hours: Identify all Ubuntu 22.04, 24.04, and 26.04 LTS systems running snap applications and determine their snap-confine deployment method (file capabilities vs. setuid-root). Within 7 days: On high-value systems, migrate snap-confine to traditional setuid-root binary deployment or disable snap applications where operationally feasible; restrict unprivileged local user account creation on critical systems. Within 30 days: Establish vendor patch monitoring for this CVE and develop automated patching procedures for immediate deployment once available; audit all affected systems for exploitation indicators; implement discretionary access controls and file integrity monitoring to limit local attacker impact.

snap-confine CVE-2026-8933

EUVD-2026-46262 HIGH

Execution with Unnecessary Privileges (CWE-250)

2026-07-21 canonical

GHSA-fxqr-j4gx-622c

Privilege Escalation RCE Canonical Ubuntu 22 04 Lts Ubuntu 24 04 Lts Ubuntu 26 04 Lts

7.8

CVSS 3.1 · Vendor: canonical

Severity by source

Vendor (canonical) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local vector and low-privileged local account required (AV:L/PR:L), no interaction, and successful escalation yields full root so C/I/A all High; scope unchanged as it stays on the same host.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (canonical).

CVSS VectorVendor: canonical

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 15:00 vuln.today

CVE Published

Jul 21, 2026 - 14:02 cve.org

HIGH 7.8

DescriptionCVE.org

A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally by Canonical snapd to construct the secure execution environment for snap applications. This vulnerability uniquely affects versions of snap-confine configured with set-capabilities (rather than standard set-uid-root installations). Due to a flaw in how privilege boundaries or security sandboxes are initialized when the binary runs under limited ambient capabilities, a local, unprivileged attacker can exploit this behavior to bypass intended restrictions and execute arbitrary code. Successful exploitation allows the local user to elevate their privileges to full root authority.

AnalysisAI

Local privilege escalation in snap-confine - the SUID/set-capabilities helper snapd uses to build the confinement sandbox for snap applications - lets an unprivileged local user on Ubuntu 22.04, 24.04, and 26.04 LTS gain full root. The flaw only manifests where snap-confine is deployed with file capabilities (set-capabilities) instead of the traditional set-uid-root binary, where incorrect handling of ambient capabilities lets an attacker escape intended privilege boundaries and run arbitrary code as root. Reported by Canonical; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

snap-confine is the core privileged component of Canonical's snapd that constructs the secure execution environment (namespaces, mounts, seccomp, capability set) before a snap application starts. Historically it runs set-uid-root, but it can alternatively be installed with Linux file capabilities (set-capabilities), granting it a bounded capability set rather than full root euid. This CVE is classified CWE-250 (Execution with Unnecessary Privileges): during sandbox initialization under the set-capabilities model, privilege boundaries are set up incorrectly relative to the process's limited ambient capabilities, so privileges that should have been dropped or never granted remain reachable. The CPE data scopes this to Canonical's Ubuntu 22.04, 24.04, and 26.04 LTS platforms, all of which ship snapd with snap-confine as a trusted privileged helper.

RemediationAI

Patch available per vendor advisory: apply the snapd/snap-confine security update for your Ubuntu release (22.04, 24.04, or 26.04 LTS) via the normal package channel (e.g. apt update && apt upgrade of snapd), following the exact fixed package versions published in the Canonical advisory at https://ubuntu.com/security/CVE-2026-8933 - the input does not contain a specific fixed version number, so do not assume one. As a compensating control until patched, determine whether snap-confine is running in the vulnerable set-capabilities mode (check file capabilities on the snap-confine binary with getcap); hosts using the default set-uid-root install are not exposed. On affected hosts, the highest-value interim control is to restrict local shell access on multi-user systems, since this is a local-only escalation with no remote vector; reverting snap-confine to the set-uid-root configuration removes the vulnerable code path but should only be done per Canonical guidance as it changes the confinement model.