NexaPulse
Subscribe
7.4highHigh

CVE-2026-35535

Sudo Project Sudo

In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation.

Exploitation status

  • A vendor advisory or patch reference has been published.

What the metrics mean

  • It is requires local access to the machine.
  • For an attacker who can reach it, exploitation depends on conditions outside the attacker's control.
  • To exploit it, no account is needed.
  • Beyond that, no action by a user is required.

Scoring

CVSS
7.4 (v3.1)
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-271
Assigned by
cve@mitre.org

Dates

Published
2026-04-03
Last modified
2026-09-01
Sources
NVD

Affected products

  • Sudo Project Sudo- 1.9.17, 1.9.17
  • Siemens Sinec Os- 4.0
  • Siemens Ruggedcom Rst2428pall versions

As listed in the NVD configuration data. Not a statement about your estate.

References