{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35535", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-04-03T02:21:32.829Z", "datePublished": "2026-04-03T02:21:33.584Z", "dateUpdated": "2026-04-04T03:55:19.379Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Sudo", "vendor": "Sudo project", "versions": [{"lessThan": "3e474c2f201484be83d994ae10a4e20e8c81bb69", "status": "affected", "version": "0", "versionType": "git"}]}], "descriptions": [{"lang": "en", "value": "In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-271", "description": "CWE-271 Privilege Dropping / Lowering Errors", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-03T02:21:33.584Z"}, "references": [{"url": "https://github.com/sudo-project/sudo/commit/3e474c2f201484be83d994ae10a4e20e8c81bb69"}, {"url": "https://www.qualys.com/2026/03/10/crack-armor.txt"}, {"url": "https://bugs.launchpad.net/ubuntu/+source/sudo/+bug/2143042"}, {"url": "https://bugs.debian.org/1130593"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-03T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-35535"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-04T03:55:19.379Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-35535", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-03T13:14:52.302723Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-03T13:14:56.484Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Sudo project", "product": "Sudo", "versions": [{"status": "affected", "version": "0", "lessThan": "3e474c2f201484be83d994ae10a4e20e8c81bb69", "versionType": "git"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/sudo-project/sudo/commit/3e474c2f201484be83d994ae10a4e20e8c81bb69"}, {"url": "https://www.qualys.com/2026/03/10/crack-armor.txt"}, {"url": "https://bugs.launchpad.net/ubuntu/+source/sudo/+bug/2143042"}, {"url": "https://bugs.debian.org/1130593"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-271", "description": "CWE-271 Privilege Dropping / Lowering Errors"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-03T02:21:33.584Z"}}}, "cveMetadata": {"cveId": "CVE-2026-35535", "state": "PUBLISHED", "dateUpdated": "2026-04-04T03:55:19.379Z", "dateReserved": "2026-04-03T02:21:32.829Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-04-03T02:21:33.584Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation."}], "id": "CVE-2026-35535", "lastModified": "2026-04-03T16:10:23.730", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.4, "impactScore": 5.9, "source": "cve@mitre.org", "type": "Secondary"}]}, "published": "2026-04-03T03:16:18.233", "references": [{"source": "cve@mitre.org", "url": "https://bugs.debian.org/1130593"}, {"source": "cve@mitre.org", "url": "https://bugs.launchpad.net/ubuntu/+source/sudo/+bug/2143042"}, {"source": "cve@mitre.org", "url": "https://github.com/sudo-project/sudo/commit/3e474c2f201484be83d994ae10a4e20e8c81bb69"}, {"source": "cve@mitre.org", "url": "https://www.qualys.com/2026/03/10/crack-armor.txt"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-271"}], "source": "cve@mitre.org", "type": "Primary"}]}

{"bugzilla": {"description": "sudo: Sudo: Privilege escalation due to failure in privilege drop calls", "id": "2454714", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454714"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-272", "details": ["A flaw was found in Sudo. A local user could exploit a failure in the setuid, setgid, or setgroups calls, which are used to drop privileges before running the mailer. This oversight allows for privilege escalation, enabling the user to gain elevated access on the system."], "name": "CVE-2026-35535", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "sudo", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "sudo", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "sudo", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "sudo", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "sudo", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-04-03T02:21:33Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-35535\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-35535\nhttps://bugs.debian.org/1130593\nhttps://bugs.launchpad.net/ubuntu/+source/sudo/+bug/2143042\nhttps://github.com/sudo-project/sudo/commit/3e474c2f201484be83d994ae10a4e20e8c81bb69\nhttps://www.qualys.com/2026/03/10/crack-armor.txt"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3e474c2f201484be83d994ae10a4e20e8c81bb69)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Sudo", "source": "cna", "vendor": "Sudo project"}, "product": "sudo", "vendor": "sudo_project"}], "analysis": {"en": {"generated_at": "2026-04-04T04:23:14.398610+00:00", "value": {"mitigation_remediation": ["Update Sudo to a version that includes commit 3e474c2 or later, ensuring proper privilege dropping during mailer execution.", "If an update is not possible, configure sudoers to disable the mailer feature or restrict which users can invoke it, thereby reducing the attack surface.", "Verify that privilege drops are functioning correctly by inspecting system logs for setuid failures and testing \"sudo -l -v\" to confirm no unintended elevation.", "Implement host\u2011based intrusion detection and audit controls to detect anomalous privilege escalation attempts."], "summary": {"action": "Immediate Patch", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "The vulnerability affects all releases of the Sudo project through version 1.9.17p2 prior to the commit 3e474c2. Any system running that version of Sudo and with the mailer feature enabled is vulnerable.", "description_and_impact": "A failure of the setuid, setgid, or setgroups system call during a privilege\u2011dropping step before the mailer is executed means the error is ignored and the process can continue with elevated privileges. This flaw allows a non\u2011root user who can invoke the mailer to retain root rights, granting the attacker full system control. The weakness aligns with authorization and privilege\u2011dropping errors, reflected by CWE\u2011271 and CWE\u2011272.", "risk_and_exploitability": "The CVSS score of 7.4 indicates a high impact, but the EPSS score of less than 1% suggests a low probability of exploitation in the wild. Because the flaw is triggered by attempting to drop privileges during mailer execution, the attack vector is most likely local, requiring the ability to run a command via sudo that invokes the mailer. The issue is not listed in the CISA KEV catalog and no public exploit has been reported; however, an attacker with local sudo access can immediately gain root privileges if the flaw is present."}}}}, "created": "2026-04-03T07:31:12.665352+00:00", "updated": "2026-04-07T07:55:13.341192+00:00", "vendors": ["sudo_project", "sudo_project$PRODUCT$sudo"]}