Loading vulnerability…
Local privilege escalation in Sudo mailer privilege dropping
CVE-2026-35535 is a local privilege-escalation vulnerability in Sudo through version 1.9.17p2 before the privilege-drop error-handling fix. Before executing the mailer, Sudo attempts to drop privileges using setuid, setgid, or setgroups. Failures of these calls are not treated as fatal errors, allowing execution to continue with privileges that should have been relinquished. Under exploitable conditions, this can allow a local attacker to gain elevated access.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can elevate a local attacker's privileges and potentially compromise system confidentiality, integrity, and availability. The mailer may execute with unintended elevated user or group privileges after a failed privilege drop, undermining the intended security boundary.
If you can’t patch tonight, do this now.
No specific workaround is documented. Until patched, restrict local access to affected systems, minimize accounts able to invoke Sudo, enforce least privilege through Sudo policy, and monitor for anomalous Sudo mailer invocation or unexpected privileged child processes.
Patch, then assume compromise.
Install a vendor-supported Sudo package incorporating upstream commit 3e474c2 or an equivalent backported fix that treats privilege-drop failures as fatal before mailer execution. Update related packages, including sudo-python-plugin where required by the distribution advisory. Fixed package examples include RHEL 8 version 1.9.5p2-1.el8_10.5 and Echo version 1.9.16p2-3+deb13u1+e1. For affected VMware Tanzu RabbitMQ deployments, upgrade to the corresponding fixed branch release: 4.1.12, 4.2.7, or 4.3.1. Distribution backports mean that an older upstream version number alone does not establish vulnerability.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
41 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.