Skip to main content

Sudo EUVDEUVD-2026-18571

| CVE-2026-35535 HIGH
Privilege Dropping / Lowering Errors (CWE-271)
2026-04-03 mitre GHSA-g5fc-f834-rcr2
Privilege Escalation Sudo Sudo Project
7.8
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain local low-privileged shell
  2. Delivery
    Exhaust process/resource limits
  3. Exploit
    Trigger sudo action invoking mailer
  4. Execution
    setuid/setgid drop fails non-fatally
  5. Persist
    Mailer exec'd with retained root
  6. Impact
    Execute commands as root

Vulnerability Assessment

Weakness
CWE
CWE-271
ASVS 5.0
V8 - Authorization Privilege dropping
Exploitation Conditions

Requires an existing local account with at least limited sudo access (PR:L, AV:L), and the target system must be running Sudo configured to send mail - i.e. mailer notifications such as mail_badpass, mail_no_user, or mail_always enabled and a mailer path set; on systems with mail disabled the vulnerable code path is not reached. Exploitation further depends on actually causing a setuid/setgid/setgroups call to FAIL during the privilege drop, which realistically demands inducing a resource limit or similar failure (e.g. RLIMIT_NPROC exhaustion). Limiting factors: not remotely exploitable, attacker must already be authenticated locally, and default builds without mailer notifications are not affected - so this is non-default-configuration dependent rather than a default-config exposure.
Impact

Signals are mostly aligned toward a real-but-not-urgent local issue. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects local access by an already-authenticated low-privileged user with full CIA impact (root), and SSVC confirms 'Technical Impact: total.' However, SSVC also reports 'Exploitation: none' and 'Automatable: no,' and EPSS is 0.00% (0th percentile), with no KEV listing and no public exploit identified - indicating this is not under active or widespread exploitation. A key nuance the raw CVSS understates: triggering the bug requires forcing a setuid/setgid/setgroups syscall to FAIL, which in practice means resource-exhaustion conditions (e.g. hitting RLIMIT_NPROC) rather than a simple call - arguably higher attack complexity than the published AC:L suggests. Net: a high-impact local EoP that should be patched in normal cycles, not an emergency, and primarily relevant where Sudo's mailer notifications are enabled.
Exploit ScenarioDerived

A local user with limited sudo rights arranges resource-exhaustion conditions (for example exhausting their process limit) and then triggers a sudo action that causes Sudo to send a notification mail; the privilege-drop syscalls fail silently and the mailer is exec'd while still privileged, giving the attacker a path to root command execution. The attack is local and authenticated (PR:L) with no user interaction, but no public exploit is identified at time of analysis.
Act Now Prioritize within 24-48h. Why: Active threat signals + CRITICAL/HIGH severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv5 – Jun 30, 2026

Local privilege escalation in Sudo through 1.9.17p2 (fixed in commit 3e474c2) arises because a failed setuid, setgid, or setgroups call during the privilege drop that precedes invoking the mailer is treated as non-fatal, allowing the mailer to run with retained elevated privileges. Local users on systems where Sudo is configured to send mail can leverage this to gain root, with total technical impact per CISA SSVC. EPSS is 0.00% and there is no public exploit identified at time of analysis, consistent with SSVC marking exploitation as none.

Earlier versions of this analysis (4)
v4 Jun 30, 2026 - 04:38 cvss changed CVSS 7.8

Local privilege escalation to root in Sudo through 1.9.17p2 (fixed in commit 3e474c2) arises because failures of setuid, setgid, or setgroups during the privilege drop that precedes launching the mail program are treated as non-fatal. As a result the configured mailer can be executed without fully relinquishing root credentials or supplementary groups, giving a local user a path to elevated execution. There is no public exploit identified at time of analysis, EPSS is 0.00%, and CISA SSVC marks exploitation as none, but the technical impact is rated total.

v3 Jun 30, 2026 - 04:38 cvss changed CVSS 7.8

Local privilege escalation in Sudo (all versions through 1.9.17p2, fixed in commit 3e474c2) arises because the setuid/setgid/setgroups calls used to drop privileges before spawning the mailer are not treated as fatal on failure, so a failed privilege drop lets the mailer subprocess run with retained root context (CWE-271). With EPSS at 0.00% and CISA SSVC marking exploitation as 'none', there is no public exploit or active exploitation identified, but the technical impact is rated total. The flaw affects the near-universal Sudo binary and has been patched by upstream and shipped by SUSE, Red Hat, and Debian.

v2 Jun 30, 2026 - 04:37 cvss changed CVSS 7.8

Local privilege escalation in Sudo through 1.9.17p2 (prior to upstream commit 3e474c2) arises because a failed setuid, setgid, or setgroups call while dropping privileges before invoking the mailer is treated as non-fatal, so the mailer can run with retained elevated privileges. This affects systems where sudo is configured to send notification mail, and a local user able to force the privilege-drop syscalls to fail could leverage the mailer to execute code or operations at root. No public exploit has been identified at time of analysis, EPSS is 0.00%, and CISA SSVC records exploitation status as none.

v1 Apr 03, 2026 - 02:30 CVSS 7.4

Privilege escalation to root in Sudo ≤1.9.17p2 occurs when setuid/setgid/setgroups system calls fail during the mailer privilege-drop sequence, allowing local attackers with high complexity exploitation to gain full system control. Confirmed actively exploited (CISA KEV). EPSS score and public exploit code status indicate significant real-world risk despite the high attack complexity barrier.

RemediationAI

Apply your distribution's updated Sudo package: Upstream fix available (commit 3e474c2f201484be83d994ae10a4e20e8c81bb69) - released patched version not independently confirmed from the input, so deploy the vendor-released errata that incorporate it, e.g. Red Hat RHSA-2026:10758 / 11521 / 12310 (https://access.redhat.com/errata/RHSA-2026:10758), SUSE-SU-2026:1308/1309/1359 (https://www.suse.com/support/update/SUSE-SU-2026:1308/), or the Debian LTS update (https://lists.debian.org/debian-lts-announce/2026/06/msg00003.html). As an interim compensating control until patched, disable Sudo's mail notifications in sudoers - set 'mailerpath' to none or turn off mail_badpass, mail_no_user, mail_always and related mail_* options - since the vulnerable code path only runs when Sudo invokes the mailer; the trade-off is loss of administrative email alerts on sudo events. Restricting who may run sudo at all further reduces the local attacker pool but is not a substitute for the update.

Affected VersionsENISA

sudo 0 <3e474c2f201484be83d994ae10a4e20e8c81bb69

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Sudo is the near-universal privilege-delegation utility on Linux and Unix systems, running setuid-root to execute commands as other users under policy in sudoers. When configured to notify administrators (e.g. mail_badpass, mail_no_user, or other mail_* options), Sudo forks a mailer and is supposed to permanently drop privileges to an unprivileged identity before exec'ing it. The flaw is a classic CWE-271 (Privilege Dropping / Lowering Errors) defect: the return values of setuid()/setgid()/setgroups() are not checked as fatal, so if any of those calls fails the code continues and the mailer executes still holding elevated UID/GID/group membership. The CPE cpe:2.3:a:sudo_project:sudo identifies the upstream sudo_project codebase, and the fix commit makes such failures abort execution.

Know when Sudo gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.0 HIGH

Local authenticated user (AV:L/PR:L); AC:H because the attacker must force a setuid/setgid syscall failure and have mailer notifications enabled; success yields full root (C/I/A:H).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 7.4 HIGH
AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat 7.4 HIGH

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

8
Analysis Updated
Jun 30, 2026 - 04:39 vuln.today
v5 - CVSS changed
Analysis Updated
Jun 30, 2026 - 04:38 vuln.today
v4 - CVSS changed
Analysis Updated
Jun 30, 2026 - 04:38 vuln.today
v3 - CVSS changed
Analysis Updated
Jun 30, 2026 - 04:37 vuln.today
v2 - CVSS changed
CVSS changed
Jun 30, 2026 - 03:24 NVD
7.4 (HIGH) 7.8 (HIGH)
Analysis Updated
Apr 16, 2026 - 06:07 EUVD-patch-fix
executive summary
Patch available
Apr 16, 2026 - 05:29 EUVD
3e474c2f201484be83d994ae10a4e20e8c81bb69
CVE Published
Apr 03, 2026 - 02:21 nvd
HIGH 7.4

DescriptionNVD

In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation.

Executive ViewAI

Why It Matters

CVE-2026-35535 affects Sudo systems and allows users with system access to gain root-level privileges on systems configured to send mail notifications. No public exploit identified at time of analysis, and a vendor patch is available. Organizations must prioritize updates to prevent unauthorized administrative access that could compromise system integrity and regulatory compliance.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

Threat Score
5.1/10
Composite threat intelligence
EPSS Score
0.0%
Top 100% exploitable
Prevalence
Ubiquitous
Sudo is the default privilege tool on nearly all Linux/Unix systems
Threat Intel
1
1 source
Exploit
POC
Public exploit code exists
Data Quality
9 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment CISA Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.0%
Patch available Yes
Active threat Yes
Deciding rule
Active threat signals + CRITICAL/HIGH severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

69
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: +20
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.

More in Sudo

View all
CVE-2025-32463 CRITICAL POC
9.3 Jun 30

Sudo before 1.9.17p1 contains a local root escalation vulnerability (CVE-2025-32463, CVSS 9.3) through the --chroot opti
CVE-2012-0809 HIGH POC
7.2 Feb 01

Format string vulnerability in the sudo_debug function in Sudo 1.8.0 through 1.8.3p1 allows local users to execute arbit
CVE-2025-32462 HIGH POC
8.8 Jun 30

Incorrect host matching in Sudo before 1.9.17p1 allows local attackers to execute commands on unintended machines when t
CVE-2013-1775 MEDIUM POC
6.9 Mar 05

sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate attackers to bypas
CVE-2023-22809 HIGH POC
7.8 Jan 18

In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
CVE-2021-3156 HIGH POC
7.8 Jan 26

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege
CVE-2017-1000367 MEDIUM POC
6.4 Jun 05

Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_
CVE-2019-14287 HIGH POC
8.8 Oct 17

In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and se
CVE-2015-5602 HIGH POC
7.2 Nov 17

sudoedit in Sudo before 1.8.15 allows local users to gain privileges via a symlink attack on a file whose full path is d
CVE-2021-23240 HIGH POC
7.8 Jan 12

selinux_edit_copy_tfiles in sudoedit in Sudo before 1.9.5 allows a local unprivileged user to gain file ownership and es
CVE-2023-27320 HIGH POC
7.2 Feb 28

Sudo before 1.9.13p2 has a double free in the per-command chroot feature. Rated high severity (CVSS 7.2), this vulnerabi
CVE-2023-42465 HIGH POC
7.0 Dec 22

Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation) because applicatio

Same weakness CWE-271 – Privilege Dropping / Lowering Errors

View all
CVE-2022-3569 HIGH POC
7.8
CVE-2023-22648 HIGH
8.8
CVE-2019-11243 HIGH
8.1
CVE-2025-53819 HIGH
7.9
CVE-2024-35179 MEDIUM
6.8
CVE-2026-25704 MEDIUM
5.8
CVE-2025-23395 HIGH
7.3

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.92 Image SL-Micro Image SL-Micro-Base Image SL-Micro-Base-RT Image SL-Micro-Base-RT-SelfInstall Image SL-Micro-Base-RT-encrypted Image SL-Micro-Base-SelfInstall Image SL-Micro-Base-encrypted Image SL-Micro-Base-qcow Image SL-Micro-Default Image SL-Micro-Default-SelfInstall Image SL-Micro-Default-encrypted Image SL-Micro-Default-qcow Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed

Threat IntelligenceMISP

CISA Advisories
ICSA-26-188-05
Sources: CISA (public domain)

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-35535 ADVISORY https://vuldb.com/vuln/355060 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1308/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1309/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1359/ REF https://access.redhat.com/errata/RHSA-2026:10758 REF https://access.redhat.com/errata/RHSA-2026:11521 REF https://access.redhat.com/errata/RHSA-2026:12310 REF https://access.redhat.com/errata/RHSA-2026:13731 REF https://access.redhat.com/errata/RHSA-2026:13888 REF https://access.redhat.com/errata/RHSA-2026:13889 REF https://access.redhat.com/errata/RHSA-2026:13891 REF https://access.redhat.com/errata/RHSA-2026:13892 REF https://access.redhat.com/errata/RHSA-2026:13895 REF https://access.redhat.com/errata/RHSA-2026:13896 REF https://access.redhat.com/errata/RHSA-2026:14228 REF https://access.redhat.com/errata/RHSA-2026:14437 REF https://access.redhat.com/errata/RHSA-2026:19067 REF https://access.redhat.com/errata/RHSA-2026:19220 REF https://access.redhat.com/errata/RHSA-2026:20040 REF https://access.redhat.com/errata/RHSA-2026:20087 REF https://access.redhat.com/errata/RHSA-2026:21275 REF https://access.redhat.com/errata/RHSA-2026:21656 REF https://access.redhat.com/errata/RHSA-2026:21690 REF https://access.redhat.com/errata/RHSA-2026:21695 REF https://access.redhat.com/errata/RHSA-2026:23233 REF https://access.redhat.com/errata/RHSA-2026:28887 REF https://access.redhat.com/errata/RHSA-2026:30088 REF https://access.redhat.com/errata/RHSA-2026:34098 REF https://access.redhat.com/errata/RHSA-2026:58981 REF https://access.redhat.com/security/cve/CVE-2026-35535 REF https://bugs.debian.org/1130593 REF https://bugs.launchpad.net/ubuntu/+source/sudo/+bug/2143042 REF https://bugzilla.redhat.com/show_bug.cgi?id=2454714 REF https://cert-portal.siemens.com/productcert/html/ssa-253495.html REF https://github.com/sudo-project/sudo/commit/3e474c2f201484be83d994ae10a4e20e8c81bb69 REF https://lists.debian.org/debian-lts-announce/2026/06/msg00003.html REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35535.json REF https://www.qualys.com/2026/03/10/crack-armor.txt

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy