Loading story…
Red Hat disclosed CVE-2026-35535, an Important-severity local privilege escalation flaw in sudo caused by failures in setuid, setgid, or setgroups privilege-dropping calls before the mailer is executed. The weakness, tracked as CWE-272, could allow a local user on an affected system to gain elevated privileges. Red Hat assigned the issue a CVSS v3 score of 7.4, while NVD scored it 7.8.
Red Hat released a series of security advisories and updated sudo packages for affected RHEL 6 ELS, RHEL 7 ELS, multiple RHEL 8 streams including 8.6, 8.8, and 8.10 lifecycle and industry-specific channels, and RHEL 10.0 offerings. Published advisories include RHSA-2026:11521, RHSA-2026:13888, RHSA-2026:13892, RHSA-2026:13895, RHSA-2026:13896, and RHSA-2026:14228, with fixed package versions such as 1.9.5p2-1.el8_10.5, 1.9.5p2-1.el8_8.3, 1.9.5p2-1.el8_6.3, 1.8.23-10.el7_9.5, 1.8.6p3-29.el6_10.8, and 1.9.15-8.p5.el10_0.3 released across supported architectures and channels.
Get the actors, campaigns, and ATT&CK mapping behind it.
7 events from the most recent confirmed update back to the earliest known activity.
Red Hat lists Red Hat Enterprise Linux 10 as fixed for CVE-2026-35535 through security advisory RHSA-2026:10758. This was the first RHEL product stream identified in the provided references as receiving a fix for the sudo flaw.
Red Hat published CVE-2026-35535 on April 3, 2026, describing an Important-severity local privilege-escalation vulnerability in sudo caused by failed privilege-dropping calls before running the mailer. The flaw could allow a local user to gain elevated access on affected systems.
A Qualys advisory covering CVE-2026-35535 was dated March 10, 2026. Red Hat later referenced this advisory in its CVE record for the sudo privilege-escalation flaw.
Red Hat lists an additional fix for Red Hat Enterprise Linux 10 through RHSA-2026:19067, released on May 19, 2026, for CVE-2026-35535. This indicates a further security erratum for the affected RHEL 10 stream.
On May 6, 2026, Red Hat published several Important advisories addressing CVE-2026-35535 in sudo across more product streams: RHSA-2026:13888 for RHEL 10.0 EUS and related channels, RHSA-2026:13892 for RHEL 8.8 channels, RHSA-2026:13895 for RHEL 7 ELS, RHSA-2026:13896 for RHEL 6 ELS Extension, and RHSA-2026:14228 for RHEL 8.6 channels. These advisories released updated sudo packages for the affected architectures and support offerings.
Red Hat stated that CVE-2026-35535 was addressed in Red Hat Enterprise Linux 9 through security advisory RHSA-2026:12310. This adds RHEL 9 to the affected Red Hat product streams confirmed as receiving a fix for the sudo privilege-escalation flaw.
On April 29, 2026, Red Hat issued RHSA-2026:11521, an Important security advisory for Red Hat Enterprise Linux 8 that fixes CVE-2026-35535 in sudo. Updated packages version 1.9.5p2-1.el8_10.5 were released for x86_64, s390x, ppc64le, and aarch64 platforms, including Extended Life Cycle 8.10 builds.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
10 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **Important** security updates for `sssd` to address two vulnerabilities tracked as **CVE-2026-14474** and **CVE-2026-14476** across multiple Red Hat Enterprise Linux versions and support channels, including RHEL 7 ELS, RHEL 8.4/8.6/8.8, RHEL 9.2/9.4/9.6, and RHEL 10, as well as related SAP, AUS, EUS, ELS, and CodeReady Linux Builder offerings. The first flaw affects deployments using `sudo_provider=ldap` or `sudo_provider=ad`: when `ldap_sudo_search_base` is left unset, SSSD searches from the LDAP domain root for `sudoRole` objects, allowing an LDAP principal with write access in any subtree to create a malicious rule that grants arbitrary sudo privileges on every enrolled host. Red Hat said `sudo_provider=ipa` is not affected. The second flaw, **CVE-2026-14476**, stems from unsanitized `gPCFileSysPath` handling in SSSD's Active Directory GPO provider, enabling path traversal through `..` components after backslashes are converted to forward slashes. Red Hat warned that an attacker with AD GPO management access could write files outside the GPO cache as root; on SELinux-enforcing systems this can be used to target `/var/lib/sss/pubconf/krb5.include.d/` and redirect Kerberos KDC configuration for authentication bypass, while systems with SELinux permissive or disabled may face arbitrary root file write. Fixes were shipped through RHSA advisories including **RHSA-2026:41937**, **RHSA-2026:42122**, **RHSA-2026:46482**, and a series of August updates covering older and specialized RHEL channels.
Aug 25, 2026
Red Hat disclosed **CVE-2026-4878**, an Important local privilege-escalation flaw in `libcap` caused by a time-of-check-to-time-of-use race in the `cap_set_file()` function. The bug allows a local unprivileged attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file, potentially injecting or stripping capabilities from unintended executables. Red Hat said the issue can be triggered when privileged processes such as `setcap` or container tooling operate on attacker-influenced paths, assigned it a **CVSS v3 score of 6.7**, and classified it as **CWE-367**. No mitigation meeting Red Hat's criteria was listed, and the issue was credited to **Ali Raza**. Red Hat issued security errata across multiple product streams for **Red Hat Enterprise Linux 8, 9, and 10**, including standard, Extended Update Support, SAP, telecommunications, mission-critical, and Extended Life Cycle channels. Published fixes include `libcap-2.69-7.el10_1.1` and `2.69-7.el10_2.1` for RHEL 10, `libcap-2.48-10.el9_7.1` and `2.48-10.el9_8.1` for RHEL 9, and `libcap-2.48-4.el8_6.1` plus `2.48-5.el8_8.1` for affected RHEL 8 streams. Red Hat advised customers to apply the updated packages through the relevant RHSA advisories to remediate the vulnerability.
Aug 25, 2026
Red Hat released multiple **Important** kernel security advisories for **RHEL 8, RHEL 9, and RHEL 10**, including standard kernel updates and `kpatch` live patches, to remediate a broad set of Linux kernel vulnerabilities across x86_64, ppc64le, aarch64, s390x, and IBM Z platforms. The updates span base, Extended Update Support, Extended Life Cycle, SAP Solutions, AUS, and real-time offerings, with affected advisories covering RHEL 8 and 10 kernel packages as well as live patch modules for RHEL 8.8, 8.10, 9.2, 9.4, 9.6, 9.8, and 10.2. Several advisories require reboots for standard kernel package updates, while the `kpatch` releases allow remediation without rebooting on supported kernels. The fixes address recurring kernel issues including **CVE-2026-43038** in IPv6 ICMP handling, **CVE-2026-43125** in DLM length validation, **CVE-2026-43329** in netfilter flowtable action checking, **CVE-2026-46244** involving `nft_inner` IPv6 offset desynchronization, and **CVE-2026-64530**, a use-after-free flaw in net scheduler qevent handling. Red Hat also patched **CVE-2026-31692**, a privilege-related flaw in `rtnetlink` where missing `netlink_ns_capable()` checks could let an unprivileged user in a user namespace create paired interfaces such as `veth` in arbitrary network namespaces, including `init_net`; that issue was specifically tied to RHEL 8 and RHEL 10 fixes. Additional CVEs cited across the advisories include **CVE-2025-40237**, **CVE-2026-23110**, **CVE-2026-31641**, **CVE-2026-43116**, **CVE-2026-46099**, **CVE-2026-46150**, **CVE-2026-52973**, **CVE-2026-53059**, **CVE-2026-64561**, and **CVE-2026-64530**.
Aug 25, 2026