# CVE-2026-35535: Sudo privilege escalation via fail-open privilege drop in mailer

Source: https://junglewise.ai/threats/cve-2026-35535-sudo-privilege-escalation-via-fail-open-privilege-drop-in-mailer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-03. Updated: 2026-06-02  
License: CC BY 4.0 with a link back

CVE-2026-35535 · Severity: high · CVSS 7.4 · Published 2026-04-03

A vulnerability in the Sudo utility, a tool used to grant administrative privileges to users, could allow a local attacker to gain full root access to a system. The issue occurs when Sudo fails to properly drop its administrative privileges before running a mail notification program. In certain environments where security policies (like AppArmor) interfere with Sudo's ability to lower its permissions, the tool may continue running with full system authority instead of stopping, leading to a complete system takeover.

## Quick answers

**Is CVE-2026-35535 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-35535 being exploited in the wild.

**How severe is CVE-2026-35535?** High severity, with a CVSS score of 7.4, published 3 April 2026.

**Which products and versions are affected?** Sudo Project Sudo through 1.9.17p2.

**Is there a fix for CVE-2026-35535?** A patch was published on 2026-03-02: Initial fix in Ubuntu packages Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-35535 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-35535?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A privilege escalation vulnerability exists in Sudo's 'exec_mailer' function. When Sudo attempts to drop privileges (via setuid, setgid, or setgroups) before executing a mailer (like sendmail) to notify administrators of security events, it fails to treat a failure of these calls as a fatal error. In a 'fail-open' scenario—specifically demonstrated when an AppArmor profile denies the setuid capability—Sudo continues execution as root instead of terminating. An attacker can exploit this to execute the mailer with unintended elevated privileges. The fix makes these privilege-drop failures fatal and ensures both GID and UID are correctly set.

## Affected products

- Sudo Project Sudo through 1.9.17p2

## Timeline

- 2026-03-02: patched: Initial fix in Ubuntu packages
- 2026-03-10: disclosed: Qualys 'CrackArmor' advisory published
- 2026-04-02: advisory: CVE-2026-35535 assigned and NVD record published

## References

- [https://bugs.debian.org/1130593](https://bugs.debian.org/1130593)
- [https://bugs.launchpad.net/ubuntu/+source/sudo/+bug/2143042](https://bugs.launchpad.net/ubuntu/+source/sudo/+bug/2143042)
- [https://github.com/sudo-project/sudo/commit/3e474c2f201484be83d994ae10a4e20e8c81bb69](https://github.com/sudo-project/sudo/commit/3e474c2f201484be83d994ae10a4e20e8c81bb69)
- [https://www.qualys.com/2026/03/10/crack-armor.txt](https://www.qualys.com/2026/03/10/crack-armor.txt)
- [https://cert-portal.siemens.com/productcert/html/ssa-253495.html](https://cert-portal.siemens.com/productcert/html/ssa-253495.html)