{"id":"CVE-2026-77654","aliases":["EUVD-2026-72684","GHSA-3pwx-5g7f-2mvm"],"status":"published","title":"Local Privilege Escalation via Misconfigured Sudoers Entry in Horizon Security Analyzer","description":"Improper Privilege Management vulnerability in Horizon Security Analyzer (formerly AlgoSec Firewall Analyzer) on Linux, 64 bit allows Privilege Escalation and Parameter Injection.\n\nA local user with access to the command line may escalate their privileges by abusing the parameters of a command that is approved in the sudoers file. \n\n\nThis issue affects Horizon Security Analyzer : A33.10, A33.20 and A33.30.","severity":{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:Y/R:U/RE:L/U:Amber","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00141,"percentile":0.03478,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-266"],"published":"2026-09-08T10:44:32Z","modified":"2026-09-08T14:03:48Z","products":[{"vendor":"algosec","product":"horizon security analyzer"}],"references":[{"url":"https://techdocs.algosec.com/en/cves/Content/tech-notes/cves/cve-2026-77654.htm"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77654"},{"url":"https://github.com/advisories/GHSA-3pwx-5g7f-2mvm"}],"sources":{"cve":[{"id":"CVE-2026-77654","title":"Local Privilege Escalation via Misconfigured Sudoers Entry in Horizon Security Analyzer","description":"Improper Privilege Management vulnerability in Horizon Security Analyzer (formerly AlgoSec Firewall Analyzer) on Linux, 64 bit allows Privilege Escalation and Parameter Injection.\n\nA local user with access to the command line may escalate their privileges by abusing the parameters of a command that is approved in the sudoers file. \n\n\nThis issue affects Horizon Security Analyzer : A33.10, A33.20 and A33.30.","status":"published","published":"2026-09-08T10:44:32.657Z","modified":"2026-09-08T12:19:26.694Z","cvss":[{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:Y/R:U/RE:L/U:Amber","level":"medium","assessor":"cna"}],"cwes":["CWE-266"],"updated_at":"2026-11-02T14:20:15.712761Z"}],"euvd":[{"id":"EUVD-2026-72684","description":"Improper Privilege Management vulnerability in Horizon Security Analyzer (formerly AlgoSec Firewall Analyzer) on Linux, 64 bit allows Privilege Escalation and Parameter Injection.\n\nA local user with access to the command line may escalate their privileges by abusing the parameters of a command that is approved in the sudoers file. \n\n\nThis issue affects Horizon Security Analyzer : A33.10, A33.20 and A33.30.","status":"published","published":"2026-09-08T10:44:32Z","modified":"2026-09-08T12:19:26Z","cvss":[{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:Y/R:U/RE:L/U:Amber","level":"medium"}],"updated_at":"2026-11-02T17:28:29.861344Z"}],"ghsa":[{"id":"GHSA-3pwx-5g7f-2mvm","title":"Improper Privilege Management vulnerability in Horizon Security Analyzer (formerly AlgoSec...","description":"Improper Privilege Management vulnerability in Horizon Security Analyzer (formerly AlgoSec Firewall Analyzer) on Linux, 64 bit allows Privilege Escalation and Parameter Injection.\n\nA local user with access to the command line may escalate their privileges by abusing the parameters of a command that is approved in the sudoers file. \n\n\nThis issue affects Horizon Security Analyzer : A33.10, A33.20 and A33.30.","status":"published","published":"2026-09-08T12:31:29Z","modified":"2026-09-08T12:31:34Z","cvss":[{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:X/RE:L/U:Amber","level":"medium"}],"cwes":["CWE-266"],"updated_at":"2026-11-02T15:11:28.397774Z"}],"nvd":[{"id":"CVE-2026-77654","description":"Improper Privilege Management vulnerability in Horizon Security Analyzer (formerly AlgoSec Firewall Analyzer) on Linux, 64 bit allows Privilege Escalation and Parameter Injection.\n\nA local user with access to the command line may escalate their privileges by abusing the parameters of a command that is approved in the sudoers file. \n\n\nThis issue affects Horizon Security Analyzer : A33.10, A33.20 and A33.30.","status":"published","published":"2026-09-08T11:17:44.283Z","modified":"2026-09-08T14:03:48.663Z","cvss":[{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:X/RE:L/U:Amber","level":"medium","assessor":"secondary"}],"cwes":["CWE-266"],"updated_at":"2026-11-02T14:12:44.436435Z"}]}}