{"id":"CVE-2026-82474","aliases":["ALSA-2026:68692","ALSA-2026:69123","AZL-98225","BELL-CVE-2026-82474","DEBIAN-CVE-2026-82474","EUVD-2026-68130","GHSA-36m7-65w5-jm6c","MGASA-2026-0531","OESA-2026-3735","OESA-2026-3736","OESA-2026-3962","RHSA-2026:65569","RHSA-2026:68692","RHSA-2026:69123","RHSA-2026:71354","RLSA-2026:68692","RLSA-2026:69123","ROOT-OS-DEBIAN-11-CVE-2026-82474","UBUNTU-CVE-2026-82474","USN-8803-1"],"status":"published","title":"Sudo through 1.9.17p2 Intercept Policy Bypass via execveat","description":"Sudo through 1.9.17p2 fails to apply intercept policy checks to the execveat system call in ptrace-based intercept mode. Users permitted to run specific commands can execute denied programs by calling execveat directly or through fexecve, bypassing policy enforcement and logging.","severity":{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00193,"percentile":0.09124,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-693"],"published":"2026-08-29T16:35:33Z","modified":"2026-11-05T05:40:51Z","exploits":[{"source":"pocgithub","id":"paktiko1986/CVE-2026-82474","title":"paktiko1986/CVE-2026-82474","date":"2026-11-02","url":"https://github.com/paktiko1986/CVE-2026-82474"}],"fixes":[{"ecosystem":"AlmaLinux:10","package":"sudo","fixed_in":["1.9.17-10.p2.el10_2.6"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"sudo-python-plugin","fixed_in":["1.9.17-10.p2.el10_2.6"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"sudo","fixed_in":["1.9.17p2-3.el9_8.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"sudo-python-plugin","fixed_in":["1.9.17p2-3.el9_8.1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"sudo","fixed_in":["1.9.17-3"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"sudo","fixed_in":["1.9.15_p5-r3"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"sudo","fixed_in":["1.9.17_p2-r2"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"sudo","fixed_in":["1.9.17_p2-r2"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"sudo","fixed_in":["1.9.15p5-8.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"sudo","fixed_in":["1.9.15p5-8.oe2403sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"sudo","fixed_in":["1.9.15p5-8.oe2403sp3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"sudo-debuginfo","fixed_in":["0:1.9.17-10.p2.el10_2.6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"sudo-debugsource","fixed_in":["0:1.9.17-10.p2.el10_2.6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"sudo-python-plugin","fixed_in":["0:1.9.17-10.p2.el10_2.6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"sudo-python-plugin-debuginfo","fixed_in":["0:1.9.17-10.p2.el10_2.6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"sudo","fixed_in":["0:1.9.17-10.p2.el10_2.6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sudo-debuginfo","fixed_in":["0:1.9.17p2-3.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sudo-debugsource","fixed_in":["0:1.9.17p2-3.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sudo-python-plugin","fixed_in":["0:1.9.17p2-3.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sudo-python-plugin-debuginfo","fixed_in":["0:1.9.17p2-3.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"sudo","fixed_in":["0:1.9.17p2-3.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"sudo-debuginfo","fixed_in":["0:1.9.17p2-3.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"sudo-debugsource","fixed_in":["0:1.9.17p2-3.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"sudo-python-plugin-debuginfo","fixed_in":["0:1.9.17p2-3.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"sudo-debuginfo","fixed_in":["0:1.9.15-8.p5.el10_0.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"sudo-debugsource","fixed_in":["0:1.9.15-8.p5.el10_0.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"sudo-python-plugin","fixed_in":["0:1.9.15-8.p5.el10_0.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"sudo-python-plugin-debuginfo","fixed_in":["0:1.9.15-8.p5.el10_0.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"sudo","fixed_in":["0:1.9.15-8.p5.el10_0.4"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"sudo","fixed_in":["0:1.9.17-10.p2.el10_2.6"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"sudo","fixed_in":["0:1.9.17p2-3.el9_8.1"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"sudo","fixed_in":["1.9.5p2-3+deb11u4.aikido.8"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-sudo","fixed_in":["1.9.5p2-3+deb11u4.aikido.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"sudo","fixed_in":["1.9.15p5-3ubuntu5.24.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"sudo","fixed_in":["1.9.17p2-1ubuntu3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:10","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.17-10.p2.el10_2.6"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"sudo-python-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.17-10.p2.el10_2.6"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.17p2-3.el9_8.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"sudo-python-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.17p2-3.el9_8.1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.17-3"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9.12_p1-r1"},{"fixed":"1.9.15_p5-r3"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9.16_p2-r1"},{"fixed":"1.9.17_p2-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9.13_p3-r0"},{"fixed":"1.9.17_p2-r2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.13p3-1","1.9.13p3-1+deb12u1","1.9.13p3-1+deb12u2","1.9.13p3-1+deb12u3","1.9.13p3-1+deb12u4","1.9.13p3-2","1.9.13p3-3","1.9.14p2-1","1.9.15p2-1","1.9.15p2-2","1.9.15p3-1","1.9.15p4-1","1.9.15p4-2","1.9.15p5-1","1.9.15p5-2","1.9.15p5-3","1.9.15p5-3+hurd.1","1.9.16-1","1.9.16-2","1.9.16p1-1","1.9.16p2-1","1.9.16p2-2","1.9.16p2-3","1.9.17p1-1","1.9.17p2-1","1.9.17p2-1exp1","1.9.17p2-2","1.9.17p2-3","1.9.17p2-4","1.9.17p2-5","1.9.17p2-6","1.9.17p2-7","1.9.17p2-8","1.9.17p2-9"]},{"source":"osv","ecosystem":"Debian:13","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.16p2-3","1.9.16p2-3+deb13u1","1.9.16p2-3+deb13u2","1.9.17p1-1","1.9.17p2-1","1.9.17p2-1exp1","1.9.17p2-2","1.9.17p2-3","1.9.17p2-4","1.9.17p2-5","1.9.17p2-6","1.9.17p2-7","1.9.17p2-8","1.9.17p2-9"]},{"source":"osv","ecosystem":"Debian:14","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.16p2-3","1.9.17p1-1","1.9.17p2-1","1.9.17p2-1exp1","1.9.17p2-2","1.9.17p2-3","1.9.17p2-4","1.9.17p2-5","1.9.17p2-6","1.9.17p2-7","1.9.17p2-8","1.9.17p2-9"]},{"source":"osv","ecosystem":"Mageia:10","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.17p1-2.1.mga10"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.15p5-8.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.15p5-8.oe2403sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.15p5-8.oe2403sp3"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.17-16.p2.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"sudo-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.17-16.p2.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"sudo-logsrvd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.17-16.p2.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"sudo-python-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.17-16.p2.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sudo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.17-10.p2.el10_2.6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sudo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.17-10.p2.el10_2.6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sudo-python-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.17-10.p2.el10_2.6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sudo-python-plugin-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.17-10.p2.el10_2.6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.17-10.p2.el10_2.6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sudo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.17p2-3.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sudo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.17p2-3.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sudo-python-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.17p2-3.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sudo-python-plugin-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.17p2-3.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.17p2-3.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"sudo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.17p2-3.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"sudo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.17p2-3.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"sudo-python-plugin-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.17p2-3.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"sudo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.15-8.p5.el10_0.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"sudo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.15-8.p5.el10_0.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"sudo-python-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.15-8.p5.el10_0.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"sudo-python-plugin-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.15-8.p5.el10_0.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.15-8.p5.el10_0.4"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.17-10.p2.el10_2.6"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.17p2-3.el9_8.1"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.5p2-3+deb11u4.aikido.8"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.5p2-3+deb11u4.aikido.8"}]}]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.15p5-3ubuntu5.24.04.3"}]}],"versions":["1.9.14p2-1ubuntu1","1.9.15p5-3ubuntu1","1.9.15p5-3ubuntu3","1.9.15p5-3ubuntu4","1.9.15p5-3ubuntu5","1.9.15p5-3ubuntu5.24.04.1","1.9.15p5-3ubuntu5.24.04.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.17p2-1ubuntu3.1"}]}],"versions":["1.9.17p2-1ubuntu1","1.9.17p2-1ubuntu2","1.9.17p2-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.15p5-3ubuntu5.24.04.3"}]}],"versions":["1.9.14p2-1ubuntu1","1.9.15p5-3ubuntu1","1.9.15p5-3ubuntu3","1.9.15p5-3ubuntu4","1.9.15p5-3ubuntu5","1.9.15p5-3ubuntu5.24.04.1","1.9.15p5-3ubuntu5.24.04.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"sudo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.17p2-1ubuntu3.1"}]}],"versions":["1.9.17p2-1ubuntu1","1.9.17p2-1ubuntu2","1.9.17p2-1ubuntu3"]}],"products":[{"vendor":"sudo project","product":"sudo"},{"vendor":"sudo-project","product":"sudo"}],"references":[{"url":"https://github.com/sudo-project/sudo/commit/71fbe42dcd5a1c8f799540583a2dfb2ae6221edf","tags":["patch","fix","article"]},{"url":"https://github.com/sudo-project/sudo/blob/v1.9.17p2/src/exec_ptrace.c","tags":["technical-description","article"]},{"url":"https://github.com/sudo-project/sudo","tags":["product","package","article"]},{"url":"https://www.vulncheck.com/advisories/sudo-through-1.9-17p2-intercept-policy-bypass-via-execveat","tags":["third-party-advisory","advisory","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82474","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-36m7-65w5-jm6c"},{"url":"https://access.redhat.com/errata/RHSA-2026:68692","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-82474","tags":["report"]},{"url":"https://bugzilla.redhat.com/2525889","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-68692.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:69123","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-69123.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-82474","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82474.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-82474","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0531.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36362","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8803-1","tags":["advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2026/09/24/4","tags":["web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-96512","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539327","tags":["report"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3735","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3736","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3962","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:65569","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-35535","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_65569.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2454714","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-35535","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35535","tags":["advisory"]},{"url":"https://bugs.debian.org/1130593","tags":["article"]},{"url":"https://bugs.launchpad.net/ubuntu/+source/sudo/+bug/2143042","tags":["article"]},{"url":"https://github.com/sudo-project/sudo/commit/3e474c2f201484be83d994ae10a4e20e8c81bb69","tags":["article"]},{"url":"https://www.qualys.com/2026/03/10/crack-armor.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525889","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-82474","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-212546","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68692.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_69123.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:71354","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_71354.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:68692","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:69123","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-82474","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-82474","title":"Sudo through 1.9.17p2 Intercept Policy Bypass via execveat","description":"Sudo through 1.9.17p2 fails to apply intercept policy checks to the execveat system call in ptrace-based intercept mode. Users permitted to run specific commands can execute denied programs by calling execveat directly or through fexecve, bypassing policy enforcement and logging.","status":"published","published":"2026-08-29T16:35:33.836Z","modified":"2026-09-02T17:57:15.67Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T13:40:46.161838Z"}],"euvd":[{"id":"EUVD-2026-68130","description":"Sudo through 1.9.17p2 fails to apply intercept policy checks to the execveat system call in ptrace-based intercept mode. Users permitted to run specific commands can execute denied programs by calling execveat directly or through fexecve, bypassing policy enforcement and logging.","status":"published","published":"2026-08-29T16:35:33Z","modified":"2026-09-02T17:57:15Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:01:14.689075Z"}],"ghsa":[{"id":"GHSA-36m7-65w5-jm6c","title":"Sudo through 1.9.17p2 fails to apply intercept policy checks to the execveat system call in...","description":"Sudo through 1.9.17p2 fails to apply intercept policy checks to the execveat system call in ptrace-based intercept mode. Users permitted to run specific commands can execute denied programs by calling execveat directly or through fexecve, bypassing policy enforcement and logging.","status":"published","published":"2026-08-29T18:31:32Z","modified":"2026-08-29T18:31:38Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T15:11:10.168906Z"}],"nvd":[{"id":"CVE-2026-82474","description":"Sudo through 1.9.17p2 fails to apply intercept policy checks to the execveat system call in ptrace-based intercept mode. Users permitted to run specific commands can execute denied programs by calling execveat directly or through fexecve, bypassing policy enforcement and logging.","status":"published","published":"2026-08-29T17:17:59.91Z","modified":"2026-09-10T19:54:25.81Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:12:42.691315Z"}],"osv":[{"id":"BELL-CVE-2026-82474","status":"published","published":"2026-09-03T06:05:29.671596Z","modified":"2026-09-19T07:15:05.708260443Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:26.341144Z"},{"id":"CVE-2026-82474","title":"Sudo through 1.9.17p2 Intercept Policy Bypass via execveat","description":"Sudo through 1.9.17p2 fails to apply intercept policy checks to the execveat system call in ptrace-based intercept mode. Users permitted to run specific commands can execute denied programs by calling execveat directly or through fexecve, bypassing policy enforcement and logging.","status":"published","published":"2026-08-29T16:35:33.836Z","modified":"2026-10-28T11:18:38.440188511Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T15:45:18.131258Z"},{"id":"DEBIAN-CVE-2026-82474","description":"Sudo through 1.9.17p2 fails to apply intercept policy checks to the execveat system call in ptrace-based intercept mode. Users permitted to run specific commands can execute denied programs by calling execveat directly or through fexecve, bypassing policy enforcement and logging.","status":"published","published":"2026-08-29T17:17:59.91Z","modified":"2026-10-01T03:03:51.109108482Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:46:04.577397Z"},{"id":"OESA-2026-3735","title":"sudo security update","description":"Sudo is a program designed to allow a sysadmin to give limited root privileges to users and log root activity.  The basic philosophy is to give as few privileges as possible but still allow people to get their work done.\r\n\r\nSecurity Fix(es):\n\nSudo through 1.9.17p2 fails to apply intercept policy checks to the execveat system call in ptrace-based intercept mode. Users permitted to run specific commands can execute denied programs by calling execveat directly or through fexecve, bypassing policy enforcement and logging.(CVE-2026-82474)","status":"published","published":"2026-09-14T16:33:51Z","modified":"2026-09-13T16:45:29.571962445Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3736","title":"sudo security update","description":"Sudo is a program designed to allow a sysadmin to give limited root privileges to users and log root activity.  The basic philosophy is to give as few privileges as possible but still allow people to get their work done.\r\n\r\nSecurity Fix(es):\n\nSudo through 1.9.17p2 fails to apply intercept policy checks to the execveat system call in ptrace-based intercept mode. Users permitted to run specific commands can execute denied programs by calling execveat directly or through fexecve, bypassing policy enforcement and logging.(CVE-2026-82474)","status":"published","published":"2026-09-14T16:33:51Z","modified":"2026-09-13T16:45:30.608578673Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3962","title":"sudo security update","description":"Sudo is a program designed to allow a sysadmin to give limited root privileges to users and log root activity.  The basic philosophy is to give as few privileges as possible but still allow people to get their work done.\r\n\r\nSecurity Fix(es):\n\nSudo through 1.9.17p2 fails to apply intercept policy checks to the execveat system call in ptrace-based intercept mode. Users permitted to run specific commands can execute denied programs by calling execveat directly or through fexecve, bypassing policy enforcement and logging.(CVE-2026-82474)","status":"published","published":"2026-09-20T13:23:37Z","modified":"2026-09-20T13:30:31.20106732Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"RHSA-2026:65569","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-09T10:20:38Z","modified":"2026-10-17T10:17:39Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68692","title":"Red Hat Security Advisory: sudo security, bug fix, and enhancement update","status":"published","published":"2026-09-18T10:15:33Z","modified":"2026-09-25T10:14:31Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:69123","title":"Red Hat Security Advisory: sudo security update","status":"published","published":"2026-09-22T10:19:47Z","modified":"2026-09-25T10:14:38Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:71354","title":"Red Hat Security Advisory: sudo security update","status":"published","published":"2026-09-24T10:15:23Z","modified":"2026-09-25T10:15:21Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RLSA-2026:68692","title":"Important: sudo security, bug fix, and enhancement update","description":"The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root.\n\nSecurity Fix(es):\n\n* sudo: Sudo: Policy bypass allows unauthorized program execution via execveat (CVE-2026-82474)\n\nBug Fix(es) and Enhancement(s):\n\n* Use canonicalized path if user path contains \"..\"  (JIRA:Rocky Linux-212546)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-19T12:09:22.893412Z","modified":"2026-09-19T12:30:02.58109558Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:69123","title":"Important: sudo security update","description":"The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root.\n\nSecurity Fix(es):\n\n* sudo: Sudo: Policy bypass allows unauthorized program execution via execveat (CVE-2026-82474)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-22T18:04:11.996091Z","modified":"2026-09-22T18:24:41.341512375Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2026-82474","description":"Sudo through 1.9.17p2 fails to apply intercept policy checks to the execveat system call in ptrace-based intercept mode. Users permitted to run specific commands can execute denied programs by calling execveat directly or through fexecve, bypassing policy enforcement and logging.","status":"published","published":"2026-08-29T17:17:00Z","modified":"2026-09-23T02:00:06.847800101Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:57:22.213888Z"},{"id":"ALSA-2026:68692","title":"Important: sudo security, bug fix, and enhancement update","description":"The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root.  \n\nSecurity Fix(es):  \n\n  * sudo: Sudo: Policy bypass allows unauthorized program execution via execveat (CVE-2026-82474)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * Use canonicalized path if user path contains \"..\" (JIRA:AlmaLinux-212546)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-17T00:00:00Z","modified":"2026-10-29T11:30:43.476960238Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:69123","title":"Important: sudo security update","description":"The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root.  \n\nSecurity Fix(es):  \n\n  * sudo: Sudo: Policy bypass allows unauthorized program execution via execveat (CVE-2026-82474)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-21T00:00:00Z","modified":"2026-10-29T11:32:32.004713813Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"AZL-98225","title":"CVE-2026-82474 affecting package sudo for versions less than 1.9.17-3","description":"Sudo through 1.9.17p2 fails to apply intercept policy checks to the execveat system call in ptrace-based intercept mode. Users permitted to run specific commands can execute denied programs by calling execveat directly or through fexecve, bypassing policy enforcement and logging.","status":"published","published":"2026-08-29T17:17:59Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.280152Z"},{"id":"MGASA-2026-0531","title":"Updated sudo package fixes security vulnerabilities","description":"Sudo through 1.9.17p2 Intercept Policy Bypass via execveat.\n(CVE-2026-82474)\ntz environment variable allows bypass of notbefore/notafter time-based\nauthorization. (CVE-2026-96512)\n","status":"published","published":"2026-10-22T15:26:33Z","modified":"2026-10-22T15:30:03.220602385Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-82474","title":"CVE-2026-82474 in sudo - Patched by Root","description":"Root has patched CVE-2026-82474 in the sudo package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-09-14T12:03:15Z","modified":"2026-09-14T13:15:03.943391218Z","updated_at":"2026-11-02T15:53:30.44348Z"},{"id":"USN-8803-1","title":"sudo vulnerability","description":"Guannan Wang, Zhanpeng Liu, and Guancheng Li discovered that Sudo failed to\napply intercept policy checks when commands were executed under certain\ncircumstances. A local attacker permitted to run specific commands could\npossibly use this issue to bypass policy enforcement and logging, executing\nunauthorized programs.","status":"published","published":"2026-09-22T14:15:17Z","modified":"2026-09-23T02:12:42.011162729Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}