CVE-2026-35535

EUVD-2026-18571
In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.4 HIGH
LOCAL
HIGH
NONE
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 7.09%
Affected Products (NVD)
VendorProductVersion
sudo_projectsudo
𝑥
< 1.9.17
sudo_projectsudo
1.9.17
sudo_projectsudo
1.9.17:p1
sudo_projectsudo
1.9.17:p2
siemenssinec_os
𝑥
< 4.0
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
SiemensRUGGEDCOM RST2428P
𝑥
< V4.0
ADP
Red HatRed Hat Enterprise Linux 10
0:1.9.15-10.p5.el10_1 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 10
0:1.9.17-4.p2.el10_2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support
0:1.9.15-8.p5.el10_0.3 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION
0:1.8.6p3-29.el6_10.8 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Support
0:1.8.23-10.el7_9.5 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8
0:1.9.5p2-1.el8_10.5 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
0:1.9.5p2-1.el8_6.3 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.6 Telecommunications Update Service
0:1.9.5p2-1.el8_6.3 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.6 Update Services for SAP Solutions
0:1.9.5p2-1.el8_6.3 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service
0:1.9.5p2-1.el8_8.3 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions
0:1.9.5p2-1.el8_8.3 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9
0:1.9.17p2-3.el9_8 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9
0:1.9.5p2-15.el9_7 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9.0 Update Services for SAP Solutions
0:1.9.5p2-7.el9_0.6 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions
0:1.9.5p2-9.el9_2.4 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9.4 Extended Update Support
0:1.9.5p2-10.el9_4.3 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support
0:1.9.5p2-10.el9_6.3 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Container Platform 4.12
412.86.202605271418-0 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Container Platform 4.13
413.92.202605271328-0 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Container Platform 4.14
414.92.202606231112-0 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Container Platform 4.15
415.92.202606030318-0 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Container Platform 4.16
416.94.202605200242-0 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Container Platform 4.17
417.94.202606250942-0 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Container Platform 4.18
418.94.202605260517-0 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Container Platform 4.19
4.19.9.6.202605201155-0 ≤
𝑥
< *
ADP
Red HatRed Hat AI Inference Server 3.3
1782353093 ≤
𝑥
< *
ADP
Red HatRed Hat Update Infrastructure 5
1779798165 ≤
𝑥
< *
ADP
Red HatRed Hat Update Infrastructure 5
1779798222 ≤
𝑥
< *
ADP
Debian logo
Debian Releases
Debian Product
Codename
sudo
bookworm
1.9.13p3-1+deb12u4
fixed
bookworm (security)
vulnerable
bullseye
vulnerable
bullseye (security)
1.9.5p2-3+deb11u4
fixed
forky
1.9.17p2-7
fixed
sid
1.9.17p2-7
fixed
trixie
1.9.16p2-3+deb13u2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
sudo
bionic
not-affected
focal
not-affected
jammy
Fixed 1.9.9-1ubuntu2.6
released
noble
Fixed 1.9.15p5-3ubuntu5.24.04.2
released
questing
Fixed 1.9.17p2-1ubuntu1.1
released
trusty
not-affected
xenial
not-affected
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
sudo
suse enterprise server 15 SP4
1.9.9-150400.4.42.1
fixed
sudo-devel
suse enterprise server 15 SP4
1.9.9-150400.4.42.1
fixed
sudo-plugin-python
suse enterprise server 15 SP4
1.9.9-150400.4.42.1
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
sudo
RHEL 9
0:1.9.17p2-3.el9_8
fixed
sudo-python-plugin
RHEL 9
0:1.9.17p2-3.el9_8
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
sudo
Amazon Linux 2023
0:1.9.15-1.p5.amzn2023.0.3
fixed
sudo-debuginfo
Amazon Linux 2023
0:1.9.15-1.p5.amzn2023.0.3
fixed
sudo-debugsource
Amazon Linux 2023
0:1.9.15-1.p5.amzn2023.0.3
fixed
sudo-devel
Amazon Linux 2023
0:1.9.15-1.p5.amzn2023.0.3
fixed
sudo-logsrvd
Amazon Linux 2023
0:1.9.15-1.p5.amzn2023.0.3
fixed
sudo-logsrvd-debuginfo
Amazon Linux 2023
0:1.9.15-1.p5.amzn2023.0.3
fixed
sudo-python-plugin
Amazon Linux 2023
0:1.9.15-1.p5.amzn2023.0.3
fixed
sudo-python-plugin-debuginfo
Amazon Linux 2023
0:1.9.15-1.p5.amzn2023.0.3
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
sudo
Azure Linux 3.0
0:1.9.17-2.azl3
fixed
Common Weakness Enumeration
References
https://bugs.debian.org/1130593
https://bugs.launchpad.net/ubuntu/+source/sudo/+bug/2143042
https://github.com/sudo-project/sudo/commit/3e474c2f201484be83d994ae10a4e20e8c81bb69
https://www.qualys.com/2026/03/10/crack-armor.txt
https://lists.debian.org/debian-lts-announce/2026/06/msg00003.html
https://access.redhat.com/errata/RHSA-2026:10758
https://access.redhat.com/errata/RHSA-2026:11521
https://access.redhat.com/errata/RHSA-2026:12310
https://access.redhat.com/errata/RHSA-2026:13731
https://access.redhat.com/errata/RHSA-2026:13888
https://access.redhat.com/errata/RHSA-2026:13889
https://access.redhat.com/errata/RHSA-2026:13891
https://access.redhat.com/errata/RHSA-2026:13892
https://access.redhat.com/errata/RHSA-2026:13895
https://access.redhat.com/errata/RHSA-2026:13896
https://access.redhat.com/errata/RHSA-2026:14228
https://access.redhat.com/errata/RHSA-2026:14437
https://access.redhat.com/errata/RHSA-2026:19067
https://access.redhat.com/errata/RHSA-2026:19220
https://access.redhat.com/errata/RHSA-2026:20040
https://access.redhat.com/errata/RHSA-2026:20087
https://access.redhat.com/errata/RHSA-2026:21275
https://access.redhat.com/errata/RHSA-2026:21656
https://access.redhat.com/errata/RHSA-2026:21690
https://access.redhat.com/errata/RHSA-2026:21695
https://access.redhat.com/errata/RHSA-2026:23233
https://access.redhat.com/errata/RHSA-2026:28887
https://access.redhat.com/errata/RHSA-2026:30088
https://access.redhat.com/errata/RHSA-2026:34098
https://access.redhat.com/security/cve/CVE-2026-35535
https://bugzilla.redhat.com/show_bug.cgi?id=2454714
https://cert-portal.siemens.com/productcert/html/ssa-253495.html
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35535.json