CVE-2026-35535
Sudo Project Sudo ≤ 1.9.17
Raw vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2026-35535 is a high-severity Privilege Dropping / Lowering Errors (CWE-271) vulnerability in Sudo Project Sudo. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-6 (Least Privilege) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-35535 affects Sudo versions through 1.9.17p2 prior to commit 3e474c2. The vulnerability arises when Sudo attempts to drop privileges via setuid, setgid, or setgroups calls before executing the mailer utility, typically used for error notifications. If these calls fail, Sudo does not treat the failure as fatal, potentially allowing the process to continue with elevated privileges and enabling privilege escalation. The issue is classified under CWE-271 (State Management Error) with a CVSS v3.1 base score of 7.4 (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
A local attacker with no privileges (PR:N) can exploit this vulnerability, though it requires high attack complexity (AC:H). By triggering conditions that cause the privilege drop to fail—such as manipulating system resources or configurations—the attacker can prevent successful de-escalation, leading to execution of the mailer with root privileges. This grants high confidentiality, integrity, and availability impacts, facilitating full privilege escalation from an unprivileged user to root.
Advisories and patches recommend updating to Sudo versions incorporating commit 3e474c2 from the Sudo project GitHub repository, which addresses the issue by making privilege drop failures fatal. Debian bug tracker entry 1130593 and Ubuntu Launchpad bug 2143042 detail the problem in their distributions, while the Qualys advisory at qualys.com/2026/03/10/crack-armor.txt provides further analysis and confirms the patch as the primary mitigation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-18571
Vulnerability Data
In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 4 hardening rules · 4 OS baselines
—
Mitigating Controls (NIST 800-53 r5) AI
Least privilege explicitly mandates dropping privileges to the minimum necessary before transferring control.
Access enforcement directly requires that privileges are lowered before handing resources to less-privileged actors.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Explicit inclusion of least-privilege policy directly addresses failure to drop privileges before handing control to lower-privileged actors.
Secure-development practices encompass correct privilege-dropping logic, though the control is broader than this single weakness.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Restricting use of privileged utility programs forces explicit privilege lowering before handing control to unprivileged actors.
Privileged access rights explicitly require least-privilege assignment and timely revocation, directly mitigating failure to drop privileges.
Secure development lifecycle includes privilege management reviews, providing indirect coverage of the weakness.
Secure coding standards can mandate privilege-dropping calls, yet the control is broader than this single weakness.
Information access restriction supports least privilege but does not specifically mandate dropping rights after privileged operations.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Ubuntu 24.04 (1 rule)
- V-270689 Ubuntu 24.04 LTS must prevent all software from executing at higher privilege levels than users executing the software and the audit system must be configured to audit the execution of privileged functions. prevents CWE-272
Windows 10 (1 rule)
- V-220712 Only accounts responsible for the administration of a system must have Administrator rights on the system. prevents CWE-272
Windows Server 2022 (1 rule)
- V-254428 Windows Server 2022 must only allow administrators responsible for the member server or standalone or nondomain-joined system to have Administrator rights on the system. prevents CWE-272