Read the docs
TI-2026-27645 Aliases CVE-2026-35535GHSA-g5fc-f834-rcr2

In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups…

Priority LOW 35CWE-271Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00177 7th percentileScored 2026-11-07
Fix Fixed Red Hat: 26 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

No affected products listed by the sources yet.

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*before 1.9.17VulnerableSudo project
cpe:2.3:a:sudo_project:sudo:1.9.17:-:*:*:*:*:*:*1.9.17VulnerableSudo project
cpe:2.3:a:sudo_project:sudo:1.9.17:p1:*:*:*:*:*:*1.9.17 p1VulnerableSudo project
cpe:2.3:a:sudo_project:sudo:1.9.17:p2:*:*:*:*:*:*1.9.17 p2VulnerableSudo project
cpe:2.3:o:siemens:sinec_os:*:*:*:*:*:*:*:*before 4.0VulnerableSiemens
cpe:2.3:h:siemens:ruggedcom_rst2428p:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
  • cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:* Versions before 1.9.17 Vulnerable ·Sudo project
  • cpe:2.3:a:sudo_project:sudo:1.9.17:-:*:*:*:*:*:* Versions 1.9.17 Vulnerable ·Sudo project
  • cpe:2.3:a:sudo_project:sudo:1.9.17:p1:*:*:*:*:*:* Versions 1.9.17 p1 Vulnerable ·Sudo project
  • cpe:2.3:a:sudo_project:sudo:1.9.17:p2:*:*:*:*:*:* Versions 1.9.17 p2 Vulnerable ·Sudo project
  • cpe:2.3:o:siemens:sinec_os:*:*:*:*:*:*:*:* Versions before 4.0 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:ruggedcom_rst2428p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens

Remediation

Red Hat 26 advisories

  • RHSA-2026:65569 Released 2026-09-08 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images sudo-1.9.17-16.p2.1.hum1@aarch64, sudo-1.9.17-16.p2.1.hum1@src, sudo-1.9.17-16.p2.1.hum1@x86_64 +6
  • RHSA-2026:58981 Released 2026-08-24 · Red Hat rating Critical
    Red Hat Update Infrastructure 5.3 Technology Preview security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-tp-rhel9, registry.redhat.io/rhui5/installer-tp-rhel9, registry.redhat.io/rhui5/rhua-tp-rhel9
  • RHSA-2026:34098 Released 2026-07-09 · Red Hat rating Critical
    OpenShift Container Platform 4.17.55 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 rhcos-aarch64-417.94.202606250942-0, rhcos-ppc64le-417.94.202606250942-0, rhcos-s390x-417.94.202606250942-0 +1
Show 23 more Red Hat advisories
  • RHSA-2026:28887 Released 2026-07-01 · Red Hat rating Critical
    OpenShift Container Platform 4.14.68 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 rhcos-aarch64-414.92.202606231112-0, rhcos-ppc64le-414.92.202606231112-0, rhcos-s390x-414.92.202606231112-0 +1
  • RHSA-2026:30088 Released 2026-06-25 · Red Hat rating Critical
    Red Hat AI Inference Server 3.3.5 (ROCm)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2026:23233 Released 2026-06-11 · Red Hat rating Important
    OpenShift Container Platform 4.15.65 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 rhcos-aarch64-415.92.202606030318-0, rhcos-ppc64le-415.92.202606030318-0, rhcos-s390x-415.92.202606030318-0 +1
  • RHSA-2026:21695 Released 2026-06-04 · Red Hat rating Important
    OpenShift Container Platform 4.12.91 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 rhcos-x86_64-412.86.202605271418-0
  • RHSA-2026:21690 Released 2026-06-04 · Red Hat rating Important
    OpenShift Container Platform 4.13.67 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 rhcos-x86_64-413.92.202605271328-0
  • RHSA-2026:21656 Released 2026-06-03 · Red Hat rating Important
    OpenShift Container Platform 4.18.43 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 rhcos-aarch64-418.94.202605260517-0, rhcos-ppc64le-418.94.202605260517-0, rhcos-s390x-418.94.202605260517-0 +1
  • RHSA-2026:20087 Released 2026-05-29 · Red Hat rating Important
    OpenShift Container Platform 4.16.63 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 rhcos-aarch64-416.94.202605200242-0, rhcos-ppc64le-416.94.202605200242-0, rhcos-s390x-416.94.202605200242-0 +1
  • RHSA-2026:20040 Released 2026-05-27 · Red Hat rating Important
    OpenShift Container Platform 4.19.32 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 rhcos-aarch64-4.19.9.6.202605201155-0, rhcos-ppc64le-4.19.9.6.202605201155-0, rhcos-s390x-4.19.9.6.202605201155-0 +1
  • RHSA-2026:21275 Released 2026-05-27 · Red Hat rating Critical
    Red Hat Update Infrastructure 5.1 security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9, registry.redhat.io/rhui5/installer-rhel9 +1
  • RHSA-2026:19220 Released 2026-05-19 · Red Hat rating Important
    sudo security update
    • Red Hat Enterprise Linux AppStream (v. 9) sudo-python-plugin-1.9.17p2-3.el9_8
    • Red Hat Enterprise Linux BaseOS (v. 9) sudo-1.9.17p2-3.el9_8
  • RHSA-2026:19067 Released 2026-05-19 · Red Hat rating Important
    sudo security update
    • Red Hat Enterprise Linux AppStream (v. 10) sudo-python-plugin-1.9.17-4.p2.el10_2
    • Red Hat Enterprise Linux BaseOS (v. 10) sudo-1.9.17-4.p2.el10_2
  • RHSA-2026:14437 Released 2026-05-06 · Red Hat rating Important
    sudo security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) sudo-python-plugin-1.9.5p2-10.el9_4.3
    • Red Hat Enterprise Linux BaseOS EUS (v.9.4) sudo-1.9.5p2-10.el9_4.3
  • RHSA-2026:14228 Released 2026-05-06 · Red Hat rating Important
    sudo security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.6) sudo-1.9.5p2-1.el8_6.3
    • Red Hat Enterprise Linux BaseOS E4S (v.8.6) sudo-1.9.5p2-1.el8_6.3
    • Red Hat Enterprise Linux BaseOS TUS (v.8.6) sudo-1.9.5p2-1.el8_6.3
  • RHSA-2026:13889 Released 2026-05-06 · Red Hat rating Important
    sudo security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) sudo-python-plugin-1.9.5p2-10.el9_6.3
    • Red Hat Enterprise Linux BaseOS EUS (v.9.6) sudo-1.9.5p2-10.el9_6.3
  • RHSA-2026:13895 Released 2026-05-06 · Red Hat rating Important
    sudo security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) sudo-1.8.23-10.el7_9.5
    • Red Hat Enterprise Linux Server Optional (v. 7 ELS) sudo-devel-1.8.23-10.el7_9.5, sudo-devel-1.8.23-10.el7_9.5.ppc
  • RHSA-2026:13888 Released 2026-05-06 · Red Hat rating Important
    sudo security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) sudo-python-plugin-1.9.15-8.p5.el10_0.3
    • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) sudo-1.9.15-8.p5.el10_0.3
  • RHSA-2026:13891 Released 2026-05-06 · Red Hat rating Important
    sudo security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) sudo-python-plugin-1.9.5p2-9.el9_2.4
    • Red Hat Enterprise Linux BaseOS E4S (v.9.2) sudo-1.9.5p2-9.el9_2.4
  • RHSA-2026:13896 Released 2026-05-06 · Red Hat rating Important
    sudo security update
    • Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION) sudo-1.8.6p3-29.el6_10.8
    • Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION) sudo-devel-1.8.6p3-29.el6_10.8
  • RHSA-2026:13892 Released 2026-05-06 · Red Hat rating Important
    sudo security update
    • Red Hat Enterprise Linux BaseOS E4S (v.8.8) sudo-1.9.5p2-1.el8_8.3
    • Red Hat Enterprise Linux BaseOS TUS (v.8.8) sudo-1.9.5p2-1.el8_8.3
  • RHSA-2026:13731 Released 2026-05-05 · Red Hat rating Important
    sudo security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) sudo-python-plugin-1.9.5p2-7.el9_0.6
    • Red Hat Enterprise Linux BaseOS E4S (v.9.0) sudo-1.9.5p2-7.el9_0.6
  • RHSA-2026:12310 Released 2026-04-30 · Red Hat rating Important
    sudo security update
    • Red Hat Enterprise Linux AppStream (v. 9) sudo-python-plugin-1.9.5p2-15.el9_7
    • Red Hat Enterprise Linux BaseOS (v. 9) sudo-1.9.5p2-15.el9_7
  • RHSA-2026:11521 Released 2026-04-29 · Red Hat rating Important
    sudo security update
    • Red Hat Enterprise Linux BaseOS (v. 8) sudo-1.9.5p2-1.el8_10.5
  • RHSA-2026:10758 Released 2026-04-27 · Red Hat rating Important
    sudo security update
    • Red Hat Enterprise Linux AppStream (v. 10) sudo-python-plugin-1.9.15-10.p5.el10_1
    • Red Hat Enterprise Linux BaseOS (v. 10) sudo-1.9.15-10.p5.el10_1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat AI Inference Server 3.3Fixed RHSA-2026:30088
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:10758, RHSA-2026:19067
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:12310, RHSA-2026:19220
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2026:13731
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:13891
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:13888
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2026:14437
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:13889
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:10758, RHSA-2026:19067
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2026:11521
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2026:12310, RHSA-2026:19220
Red Hat Enterprise Linux BaseOS AUS (v.8.6)Fixed RHSA-2026:14228
Red Hat Enterprise Linux BaseOS E4S (v.8.6)Fixed RHSA-2026:14228
Red Hat Enterprise Linux BaseOS E4S (v.8.8)Fixed RHSA-2026:13892
Red Hat Enterprise Linux BaseOS E4S (v.9.0)Fixed RHSA-2026:13731
Red Hat Enterprise Linux BaseOS E4S (v.9.2)Fixed RHSA-2026:13891
Red Hat Enterprise Linux BaseOS EUS (v. 10.0)Fixed RHSA-2026:13888
Red Hat Enterprise Linux BaseOS EUS (v.9.4)Fixed RHSA-2026:14437
Red Hat Enterprise Linux BaseOS EUS (v.9.6)Fixed RHSA-2026:13889
Red Hat Enterprise Linux BaseOS TUS (v.8.6)Fixed RHSA-2026:14228
Red Hat Enterprise Linux BaseOS TUS (v.8.8)Fixed RHSA-2026:13892
Red Hat Enterprise Linux Server (v. 7 ELS)Fixed RHSA-2026:13895
Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION)Fixed RHSA-2026:13896
Red Hat Enterprise Linux Server Optional (v. 7 ELS)Fixed RHSA-2026:13895
Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION)Fixed RHSA-2026:13896
Red Hat Hardened ImagesFixed RHSA-2026:65569
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2026:21695
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2026:21690
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2026:28887
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2026:23233
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2026:20087
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2026:34098
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2026:21656
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2026:20040
Red Hat Update Infrastructure 5Fixed RHSA-2026:21275, RHSA-2026:58981
Not affected: 1 product
  • Red Hat Update Infrastructure 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-35535
  2. 2026-10-03 Alias added: GHSA-g5fc-f834-rcr2
  3. 2026-10-16 Affected versions changed · Red Hat

References

Patch 1

Advisory 2

Other 2

  • TI-2025-23530 Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf… KEVCVSS 3.1CRITICAL 9.3
  • TI-2021-02242 Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer… KEVCVSS 3.1HIGH 7.8
  • TI-2019-10640 In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass… CVSS 3.1HIGH 8.8
  • TI-2023-08978 In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed… CVSS 3.1HIGH 7.8
  • TI-2019-13477 In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a… CVSS 3.1HIGH 7.8
  • TI-2025-23529 Incorrect authorization in Sudo CVSS 3.1HIGH 8.8
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences