Skip to content
Fencer Vulns
high 7.4

CVE-2026-35535 json

In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the maile…

published 2026-04-03 7 mo ago modified 2026-09-01 2 mo ago also EUVD-2026-18571

cvss
7.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 7%
public exploits
0
none known

Summary

In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation.

Patch / fix

  • Siemens RUGGEDCOM RST2428P V4.0
  • Red Hat Red Hat Enterprise Linux 10 0:1.9.15-10.p5.el10_1, 0:1.9.17-4.p2.el10_2
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:1.9.15-8.p5.el10_0.3
  • Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION 0:1.8.6p3-29.el6_10.8
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:1.8.23-10.el7_9.5
  • Red Hat Red Hat Enterprise Linux 8 0:1.9.5p2-1.el8_10.5
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:1.9.5p2-1.el8_6.3
  • Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service 0:1.9.5p2-1.el8_6.3
  • Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions 0:1.9.5p2-1.el8_6.3
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 0:1.9.5p2-1.el8_8.3
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 0:1.9.5p2-1.el8_8.3
  • Red Hat Red Hat Enterprise Linux 9 0:1.9.5p2-15.el9_7, 0:1.9.17p2-3.el9_8
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions 0:1.9.5p2-7.el9_0.6
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:1.9.5p2-9.el9_2.4
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support 0:1.9.5p2-10.el9_4.3
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:1.9.5p2-10.el9_6.3
  • Red Hat Red Hat OpenShift Container Platform 4.12 412.86.202605271418-0
  • Red Hat Red Hat OpenShift Container Platform 4.13 413.92.202605271328-0
  • Red Hat Red Hat OpenShift Container Platform 4.14 414.92.202606231112-0
  • Red Hat Red Hat OpenShift Container Platform 4.15 415.92.202606030318-0
  • Red Hat Red Hat OpenShift Container Platform 4.16 416.94.202605200242-0
  • Red Hat Red Hat OpenShift Container Platform 4.17 417.94.202606250942-0
  • Red Hat Red Hat OpenShift Container Platform 4.18 418.94.202605260517-0
  • Red Hat Red Hat OpenShift Container Platform 4.19 4.19.9.6.202605201155-0
  • Red Hat Red Hat AI Inference Server 3.3 1782353093
  • Red Hat Red Hat Update Infrastructure 5 1779798165, 1779798222, 1787135742, 1787241260
  • sudo Debian 12 1.9.13p3-1+deb12u4
  • sudo Debian 13 1.9.16p2-3+deb13u2
  • sudo Debian 14 1.9.17p2-5

debian advisories DEBIAN-CVE-2026-35535

  • sudo Ubuntu 22.04 LTS 1.9.9-1ubuntu2.6
  • sudo Ubuntu 24.04 LTS 1.9.15p5-3ubuntu5.24.04.2
  • sudo Ubuntu 25.10 1.9.17p2-1ubuntu1.1

ubuntu advisories UBUNTU-CVE-2026-35535

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • sudo hummingbird 1 1.9.17-16.p2.1.hum1
  • sudo-logsrvd hummingbird 1 1.9.17-16.p2.1.hum1
  • sudo-python-plugin hummingbird 1 1.9.17-16.p2.1.hum1
  • sudo RHEL 9 1.9.17p2-3.el9_8
  • sudo-python-plugin RHEL 9 1.9.17p2-3.el9_8
  • sudo RHEL 10.2 1.9.17-4.p2.el10_2
  • sudo-python-plugin RHEL 10.2 1.9.17-4.p2.el10_2
  • sudo RHEL 9 1.9.5p2-15.el9_7

red hat advisories RHSA-2026:65569RHSA-2026:19220RHSA-2026:19067RHSA-2026:14437RHSA-2026:14228RHSA-2026:13895

  • sudo Linux Micro 6.2 1.9.17p1-160000.3.1
  • sudo Linux Micro 6.1 1.9.15p5-slfo.1.1_3.1
  • sudo SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Basesystem 15 SP7 1.9.15p5-150600.3.15.1
  • sudo SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Micro 5.4 +3 more 1.9.9-150400.4.42.1
  • sudo SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +2 more 1.9.12p1-150500.7.16.1

suse advisories SUSE-SU-2026:21273-1SUSE-SU-2026:21252-1SUSE-SU-2026:1359-1SUSE-SU-2026:1309-1SUSE-SU-2026:1308-1

  • sudo openSUSE Leap 16.0 1.9.17p1-160000.3.1
  • sudo openSUSE Tumbleweed 1.9.17p2-2.1

opensuse advisories openSUSE-SU-2026:20604-1openSUSE-SU-2026:10510-1

  • sudo AlmaLinux 10 1.9.17-4.p2.el10_2
  • sudo-python-plugin AlmaLinux 10 1.9.17-4.p2.el10_2
  • sudo AlmaLinux 9 1.9.17p2-3.el9_8
  • sudo-python-plugin AlmaLinux 9 1.9.17p2-3.el9_8
  • sudo AlmaLinux 9 1.9.5p2-15.el9_7
  • sudo-python-plugin AlmaLinux 9 1.9.5p2-15.el9_7
  • sudo AlmaLinux 8 1.9.5p2-1.el8_10.5
  • sudo AlmaLinux 10 1.9.15-10.p5.el10_1

almalinux advisories ALSA-2026:19067ALSA-2026:19220ALSA-2026:12310ALSA-2026:11521ALSA-2026:10758

  • sudo Rocky Linux 10 1.9.17-4.p2.el10_2
  • sudo Rocky Linux 9 1.9.17p2-3.el9_8
  • sudo Rocky Linux 9 1.9.5p2-15.el9_7
  • sudo Rocky Linux 8 1.9.5p2-1.el8_10.5
  • sudo Rocky Linux 10 1.9.15-10.p5.el10_1

rocky linux advisories RLSA-2026:19067RLSA-2026:19220RLSA-2026:12310RLSA-2026:11521RLSA-2026:10758

  • sudo Azure Linux 3.0 1.9.17-2

azure linux advisories AZL-81861

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-35535 updated cvss 7.4

sudo: Sudo: Privilege escalation due to failure in privilege drop calls

  • Red Hat AI Inference Server 3.3 rhaiis/vllm-rocm-rhel9 1782353093
    fixed: vendor fix RHSA-2026:30088
  • Red Hat Enterprise Linux AppStream (v. 9) sudo-python-plugin 1.9.17p2-3.el9_8, sudo-python-plugin 1.9.5p2-15.el9_7
    fixed: vendor fix RHSA-2026:12310
  • Red Hat Enterprise Linux AppStream (v. 10) sudo-python-plugin 1.9.17-4.p2.el10_2, sudo-python-plugin 1.9.15-10.p5.el10_1
    fixed: vendor fix RHSA-2026:10758
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) sudo-python-plugin 1.9.5p2-7.el9_0.6
    fixed: vendor fix RHSA-2026:13731
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) sudo-python-plugin 1.9.5p2-9.el9_2.4
    fixed: vendor fix RHSA-2026:13891
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) sudo-python-plugin 1.9.15-8.p5.el10_0.3
    fixed: vendor fix RHSA-2026:13888
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) sudo-python-plugin 1.9.5p2-10.el9_4.3
    fixed: vendor fix RHSA-2026:14437
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) sudo-python-plugin 1.9.5p2-10.el9_6.3
    fixed: vendor fix RHSA-2026:13889
show 27 more
  • Red Hat Enterprise Linux BaseOS (v. 8) sudo 1.9.5p2-1.el8_10.5
    fixed: vendor fix RHSA-2026:11521
  • Red Hat Enterprise Linux BaseOS (v. 9) sudo 1.9.17p2-3.el9_8, sudo 1.9.5p2-15.el9_7
    fixed: vendor fix RHSA-2026:12310
  • Red Hat Enterprise Linux BaseOS (v. 10) sudo 1.9.17-4.p2.el10_2, sudo 1.9.15-10.p5.el10_1
    fixed: vendor fix RHSA-2026:10758
  • Red Hat Enterprise Linux BaseOS AUS (v.8.6) sudo 1.9.5p2-1.el8_6.3 Red Hat Enterprise Linux BaseOS E4S (v.8.6) sudo 1.9.5p2-1.el8_6.3
    fixed: vendor fix RHSA-2026:14228
  • Red Hat Enterprise Linux BaseOS E4S (v.8.8) sudo 1.9.5p2-1.el8_8.3
    fixed: vendor fix RHSA-2026:13892
  • Red Hat Enterprise Linux BaseOS E4S (v.9.0) sudo 1.9.5p2-7.el9_0.6
    fixed: vendor fix RHSA-2026:13731
  • Red Hat Enterprise Linux BaseOS E4S (v.9.2) sudo 1.9.5p2-9.el9_2.4
    fixed: vendor fix RHSA-2026:13891
  • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) sudo 1.9.15-8.p5.el10_0.3
    fixed: vendor fix RHSA-2026:13888
  • Red Hat Enterprise Linux BaseOS EUS (v.9.4) sudo 1.9.5p2-10.el9_4.3
    fixed: vendor fix RHSA-2026:14437
  • Red Hat Enterprise Linux BaseOS EUS (v.9.6) sudo 1.9.5p2-10.el9_6.3
    fixed: vendor fix RHSA-2026:13889
  • Red Hat Enterprise Linux BaseOS TUS (v.8.6) sudo 1.9.5p2-1.el8_6.3
    fixed: vendor fix RHSA-2026:14228
  • Red Hat Enterprise Linux BaseOS TUS (v.8.8) sudo 1.9.5p2-1.el8_8.3
    fixed: vendor fix RHSA-2026:13892
  • Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION) sudo 1.8.6p3-29.el6_10.8
    fixed: vendor fix RHSA-2026:13896
  • Red Hat Enterprise Linux Server (v. 7 ELS) sudo 1.8.23-10.el7_9.5
    fixed: vendor fix RHSA-2026:13895
  • Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION) sudo-devel 1.8.6p3-29.el6_10.8, sudo-debuginfo 1.8.6p3-29.el6_10.8
    fixed: vendor fix RHSA-2026:13896
  • Red Hat Enterprise Linux Server Optional (v. 7 ELS) sudo-devel 1.8.23-10.el7_9.5, sudo-debuginfo 1.8.23-10.el7_9.5
    fixed: vendor fix RHSA-2026:13895
  • Red Hat Hardened Images sudo 1.9.17-16.p2.1.hum1, sudo-logsrvd 1.9.17-16.p2.1.hum1, sudo-python-plugin 1.9.17-16.p2.1.hum1
    fixed: vendor fix RHSA-2026:65569
  • Red Hat OpenShift Container Platform 4.12 rhcos 412.86.202605271418
    fixed: vendor fix RHSA-2026:21695
  • Red Hat OpenShift Container Platform 4.13 rhcos 413.92.202605271328
    fixed: vendor fix RHSA-2026:21690
  • Red Hat OpenShift Container Platform 4.14 rhcos 414.92.202606231112
    fixed: vendor fix RHSA-2026:28887
  • Red Hat OpenShift Container Platform 4.15 rhcos 415.92.202606030318
    fixed: vendor fix RHSA-2026:23233
  • Red Hat OpenShift Container Platform 4.16 rhcos 416.94.202605200242
    fixed: vendor fix RHSA-2026:20087
  • Red Hat OpenShift Container Platform 4.17 rhcos 417.94.202606250942
    fixed: vendor fix RHSA-2026:34098
  • Red Hat OpenShift Container Platform 4.18 rhcos 418.94.202605260517
    fixed: vendor fix RHSA-2026:21656
  • Red Hat OpenShift Container Platform 4.19 rhcos 4.19.9.6.202605201155
    fixed: vendor fix RHSA-2026:20040
  • Red Hat Update Infrastructure 5 rhui5/rhua-rhel9 1779798222, rhui5/rhua-tp-rhel9 1787241260, rhui5/installer-rhel9 1779798165, rhui5/installer-tp-rhel9 1787135742
    fixed: vendor fix RHSA-2026:21275
  • Red Hat Update Infrastructure 5 rhui5/cds-rhel9 1779798159, rhui5/cds-tp-rhel9 1787241206, rhui5/haproxy-rhel9 1779798164, rhui5/cds-kubernetes-tp-rhel9 1787241211
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
7 mo ago

Exploit prediction

0.18% chance of exploitation in the next 30 days, higher than 7% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADP 3.1 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Sudo project Sudo
  • Siemens RUGGEDCOM RST2428P
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Red Hat OpenShift Container Platform 4.12
  • Red Hat Red Hat OpenShift Container Platform 4.13
  • Red Hat Red Hat OpenShift Container Platform 4.14
  • Red Hat Red Hat OpenShift Container Platform 4.15
  • Red Hat Red Hat OpenShift Container Platform 4.16
  • Red Hat Red Hat OpenShift Container Platform 4.17
  • Red Hat Red Hat OpenShift Container Platform 4.18
  • Red Hat Red Hat OpenShift Container Platform 4.19
  • Red Hat Red Hat AI Inference Server 3.3
  • Red Hat Red Hat Update Infrastructure 5

Classification

Weakness
  • CWE-271 Privilege Dropping / Lowering Errors
  • CWE-272 Least Privilege Violation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.