Sudo CVE-2026-82474 – Intercept policy bypass

CVE-2026-82474 affects Sudo through version 1.9.17p2 and impacts systems using ptrace-based intercept control mode. The vulnerability lies in Sudo's failure to enforce intercept policy checks on the execveat system call (and through fexecve). This allows users permitted to run specific commands to bypass policy enforcement and execute denied programs, violating privilege segregation and access control as configured by administrators.

The vulnerability was reported on 2026-08-29 with a CVSS score of 7.8, classified as High severity. Current status indicates that public repositories on GitHub declare containing exploits (signal detected 2026-11-02), showing the flaw is known and potentially exploitable in public environments. The consistency between the severity declaration and CVSS score confirms the critical impact for systems relying on Sudo with ptrace-based intercept mode for policy enforcement.

Administrators must prioritize verifying whether the environment uses Sudo with ptrace-based intercept and test the currently deployed version. Urgent update to a Sudo version after 1.9.17p2 is required, consulting official Sudo advisories for patching instructions. In parallel, examine audit logs to detect any anomalous execveat or fexecve execution within contexts subject to intercept policy control.