Sudo through 1.9.17p2 Intercept Policy Bypass via execveat
Priority LOW 38CWE-693Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-693.
Summary
Sudo through 1.9.17p2 fails to apply intercept policy checks to the execveat system call in ptrace-based intercept mode. Users permitted to run specific commands can execute denied programs by calling execveat directly or through fexecve, bypassing policy enforcement and logging.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00193 9th percentileScored 2026-11-07
Fix Fixed Red Hat: 5 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Sudo project | sudo | up to 1.9.17p2 | — | No fix listed | CNA |
- sudo VendorSudo project Affected up to 1.9.17p2 Fixed in — No fix listed CNA
Remediation
Red Hat 5 advisories
- RHSA-2026:71603 Released 2026-09-24 · Red Hat rating ImportantRed Hat Update Infrastructure 5.3 security update
- Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-rhel9, registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9 +2
- RHSA-2026:71354 Released 2026-09-24 · Red Hat rating Importantsudo security update
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) sudo-python-plugin-1.9.15-8.p5.el10_0.4
- Red Hat Enterprise Linux BaseOS EUS (v. 10.0) sudo-1.9.15-8.p5.el10_0.4
- RHSA-2026:69123 Released 2026-09-21 · Red Hat rating Importantsudo security update
- Red Hat Enterprise Linux AppStream (v. 9) sudo-python-plugin-1.9.17p2-3.el9_8.1
- Red Hat Enterprise Linux BaseOS (v. 9) sudo-1.9.17p2-3.el9_8.1
Show 2 more Red Hat advisories
- RHSA-2026:68692 Released 2026-09-17 · Red Hat rating Importantsudo security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 10) sudo-python-plugin-1.9.17-10.p2.el10_2.6
- Red Hat Enterprise Linux BaseOS (v. 10) sudo-1.9.17-10.p2.el10_2.6
- RHSA-2026:65569 Released 2026-09-08 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images sudo-1.9.17-16.p2.1.hum1@aarch64, sudo-1.9.17-16.p2.1.hum1@src, sudo-1.9.17-16.p2.1.hum1@x86_64 +6
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:68692 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:69123 |
| Red Hat Enterprise Linux AppStream EUS (v. 10.0) | Fixed | RHSA-2026:71354 |
| Red Hat Enterprise Linux BaseOS (v. 10) | Fixed | RHSA-2026:68692 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2026:69123 |
| Red Hat Enterprise Linux BaseOS EUS (v. 10.0) | Fixed | RHSA-2026:71354 |
| Red Hat Hardened Images | Fixed | RHSA-2026:65569 |
| Red Hat Update Infrastructure 5 | Fixed | RHSA-2026:71603 |
Not affected: 4 products
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Update Infrastructure 5
Timeline
- 2026-10-02 Threatist record created from CVE-2026-82474
- 2026-10-03 Alias added: GHSA-36m7-65w5-jm6c
References
More Sudo project vulnerabilities
- TI-2025-23530 Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf… KEVCVSS 3.1CRITICAL 9.3
- TI-2021-02242 Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer… KEVCVSS 3.1HIGH 7.8
- TI-2019-10640 In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass… CVSS 3.1HIGH 8.8
- TI-2023-08978 In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed… CVSS 3.1HIGH 7.8
- TI-2019-13477 In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a… CVSS 3.1HIGH 7.8
- TI-2025-23529 Incorrect authorization in Sudo CVSS 3.1HIGH 8.8
Sources
- CVE-2026-82474 · CVE Program
- CVE-2026-82474 · NVD
- FIRST EPSS
- GHSA-36m7-65w5-jm6c · GitHub Advisory Database · CC BY 4.0
- CVE-2026-82474 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences