Loading story…
Canonical disclosed and patched three snapd vulnerabilities, led by CVE-2026-8933, a high-severity local privilege escalation flaw in snap-confine that can let a local user gain root on affected Ubuntu Desktop systems. Qualys reported that Ubuntu Desktop 26.04, 25.10, and fully updated 24.04 installations using the file-capabilities configuration for snap-confine are exposed because the process retains near-root capabilities while operating with the attacker’s effective UID, allowing attacker-owned files and directories to be created during a race window. The flaw can be exploited through symlink-based arbitrary file creation and permission changes, then by planting a malicious udev rule in an AppArmor-permitted path under /run/udev/, which can be triggered to execute attacker-controlled commands as root via systemd-udevd.
Canonical also addressed CVE-2026-15226, a snap-confine sandbox confinement bypass caused by missing setuid restrictions in seccomp templates, which could let code running inside a strictly confined snap create or manipulate setuid binaries and weaken confinement boundaries. A third issue, CVE-2024-5300, involved an AppArmor base profile misconfiguration that could expose hashed passwords through systemd-userdbd. Fixes are scheduled in snapd 2.76.1 and corresponding Ubuntu package updates for Xenial, Bionic, Focal, Jammy, Noble, and Resolute, with Canonical publishing advisory USN-8579-1; Qualys said it had a working exploit for CVE-2026-8933 but reported no evidence of active exploitation.
Get the actors, campaigns, and ATT&CK mapping behind it.
5 events from the most recent confirmed update back to the earliest known activity.
Canonical resolved CVE-2026-15226, a snap-confine sandbox confinement bypass caused by missing setuid restrictions in seccomp templates. Fixed Ubuntu package versions were published for multiple supported releases, with affected versions listed as earlier than 2.76.1.
Canonical disclosed CVE-2026-8933, CVE-2024-5300, and CVE-2026-15226 in snapd, describing impacts, affected Ubuntu releases, and package updates. Canonical said fixes were being issued and that advisory USN-8579-1 would be published.
The coordinated public release for CVE-2026-8933 took place, making details of the snap-confine local privilege escalation issue public. Reporting states Canonical released coordinated fixes the same day.
Qualys reported CVE-2026-8933, a local privilege escalation flaw in snap-confine, to the Ubuntu Security Team. The bug affects Ubuntu Desktop systems where snap-confine uses Linux capabilities instead of setuid-root.
Ubuntu published a security notice page for CVE-2026-3888, introducing a distinct vulnerability not covered by the existing timeline entries. The reference identifies Ubuntu as the source and anchors the publication on 2026-03-17.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
17 references tracked. Mallory keeps watching after this page renders.
linuxsecurity.com
Open sourcecybersecuritynews.com
Open sourcecsirt.sk
Open sourcescworld.com
Open sourceblog.qualys.com
Open sourceseclists.org
Open sourceblog.qualys.com
Open sourceubuntu.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Qualys** disclosed **CVE-2026-3888**, a high-severity local privilege escalation flaw affecting default installations of **Ubuntu Desktop 24.04 and later**. The bug arises from the interaction between `snap-confine`, the setuid-root component used to build snap sandboxes, and `systemd-tmpfiles`, which periodically cleans stale data from temporary directories. An unprivileged local attacker can abuse the cleanup of `/tmp/.snap`, recreate the directory with malicious content, and eventually obtain **full root access**. The issue is rated **CVSS 7.8** and requires low privileges and no user interaction, but exploitation is constrained by a time-based window tied to the system's cleanup schedule. The vulnerable behavior is present in default Ubuntu Desktop deployments because both components are standard parts of the platform's snap confinement model. Reports note the cleanup interval is typically **30 days on Ubuntu 24.04** and **10 days on later versions**, which contributes to the exploit's higher attack complexity. **Patched versions** include `snapd` **2.73+ubuntu24.04.1** for Ubuntu 24.04 LTS, **2.73+ubuntu25.10.1** for Ubuntu 25.10 LTS, **2.74.1+ubuntu26.04.1** for Ubuntu 26.04 development builds, and **upstream snapd 2.75**. A separate report about **CVE-2026-32746** in GNU InetUtils `telnetd` describes a different, unrelated unauthenticated remote code execution issue and does not pertain to the Ubuntu `snap-confine` flaw.
Jun 29, 2026
SUSE disclosed four vulnerabilities in qSnapper’s privileged root D-Bus service, affecting versions through **1.3.2** and tracked as `CVE-2026-41045` through `CVE-2026-41048`. The flaws include a **Polkit race-condition authentication bypass**, a **path traversal** issue in the `configName` parameter, **information disclosure** through snapshot diff methods, and unsafe **authentication caching** that could allow one user’s authorization to be reused by another. SUSE said some bug chains could lead to **full local root exploitation**, while other impacts include denial of service, arbitrary file operations, and exposure of sensitive content such as diffs involving `/etc/shadow`. Upstream released **qSnapper 1.3.3** with fixes that change Polkit subject handling, validate `configName`, remove authentication caching, restrict diff access behind a new **`view-diff`** Polkit action, remove the unauthenticated `Quit` method, and harden log file permissions. SUSE also acknowledged additional defense-in-depth weaknesses in file restore logic that could support symlink-based privilege escalation or arbitrary file operations, but said those issues were not assigned separate CVEs and will be addressed later through open development.
Jun 29, 2026
UpSnap disclosed and patched two high-severity vulnerabilities in version **5.4.0** affecting the wake-on-LAN web application. One flaw, tracked as **`CVE-2026-49819`**, affected fresh installations from versions **4.4.1 through 5.3.5** and allowed an unauthenticated network-adjacent attacker to complete the initial setup flow first, claim the first superuser account, and obtain a long-lived JWT. The issue could then be chained into root-level remote code execution through the application's wake functionality, yielding a **CVSS 9.8** rating. A second flaw, **`CVE-2026-49481`**, was an authenticated OS command injection bug in device management that let a low-privileged user inject shell metacharacters into **IP** or **MAC** fields used by `wake_cmd` and `shutdown_cmd`, leading to command execution via `/bin/sh -c` on Linux or `cmd /C` on Windows. UpSnap said the initial setup issue does not affect instances that were already fully initialized, while the command injection risk primarily impacts deployments where untrusted users can create or edit devices. The project mitigated the bugs by moving first superuser creation to a one-time PocketBase link shown only in server console logs, validating IP and MAC values in the backend, adding PocketBase regex constraints, and enforcing browser-side input patterns.
Aug 13, 2026