Critical Privilege Escalation Vulnerability in Sudo Package
Summary
RLSA-2026:19067: Important: sudo security update. Affects sudo versions < 0:1.9.17-4.p2.el10_2. Fixed in 0:1.9.17-4.p2.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Sudo package is a widely used utility that allows system administrators to grant specific users the ability to execute commands with elevated privileges without needing to log in as the root user. This functionality is essential for managing system tasks securely and efficiently. However, vulnerabilities in Sudo can lead to serious security risks, including unauthorized access to sensitive system functions.
Vulnerability Detail
The vulnerability identified as CVE-2026-35535 is a privilege escalation issue stemming from a failure in privilege drop calls within the Sudo utility. This flaw allows an attacker to gain elevated privileges, potentially leading to unauthorized access and control over the system. The implications of this vulnerability are significant, as it can compromise the integrity and confidentiality of the system, allowing malicious actors to execute arbitrary commands with root privileges.
How To Fix
Minimum fixed version
0:1.9.17-4.p2.el10_2
This is the first release that contains the fix.
sudo dnf update sudoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, system administrators can limit the use of Sudo for users who do not require elevated privileges until the package is updated. This can be done by modifying the /etc/sudoers file to restrict access.
Conclusion
The privilege escalation vulnerability in the Sudo package, identified as CVE-2026-35535, poses a significant risk to system security. It is crucial for system administrators to update to the patched version of the package to mitigate this risk and ensure the integrity of their systems.
See every vulnerability recorded for sudo →
FAQ
CVE-2026-35535 is a critical vulnerability in the Sudo package that allows privilege escalation due to a failure in privilege drop calls.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
The vulnerability can lead to unauthorized access and control over the system, allowing attackers to execute arbitrary commands with root privileges.
You can update the Sudo package by running the command: sudo yum update sudo in your terminal.
The CVSS score for this vulnerability is 7.4, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for sudo.
