Is CVE-2026-45767 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45767 being exploited in the wild.

How severe is CVE-2026-45767?

Medium severity, with a CVSS score of 4.4, published 10 September 2026.

Which products and versions are affected?

OISF Suricata before 7.0.16 and 8.0.5.

Is there a fix for CVE-2026-45767?

A patch was published on 2026-05-19: Fixed in versions 7.0.16 and 8.0.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45767 attacked?

It is attacked over the network.

Am I affected by CVE-2026-45767?

Check whether you run OISF Suricata at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45767: Suricata path traversal in rule load/save command

CVE-2026-45767 · Severity: medium · CVSS 4.4 · Published 2026-09-10

Suricata is a network security monitoring and intrusion detection system used to protect enterprise networks. A malicious security rule could exploit a path traversal vulnerability to write files to arbitrary locations on the filesystem when rules are loaded or reloaded, potentially compromising system integrity or enabling further attacks.

Technologies: OISF Suricata. Vendors: OISF.

Quick answers

Is CVE-2026-45767 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45767 being exploited in the wild.
How severe is CVE-2026-45767?: Medium severity, with a CVSS score of 4.4, published 10 September 2026.
Which products and versions are affected?: OISF Suricata before 7.0.16 and 8.0.5.
Is there a fix for CVE-2026-45767?: A patch was published on 2026-05-19: Fixed in versions 7.0.16 and 8.0.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45767 attacked?: It is attacked over the network.
Am I affected by CVE-2026-45767?: Check whether you run OISF Suricata at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-22) exists in Suricata's rule processing, where the "load" and "save" dataset commands do not properly validate file paths. An attacker with the ability to provide or modify Suricata rules can specify absolute or traversal paths in the "save" parameter to write files anywhere on the filesystem during rule load or reload operations. This requires administrator/rule-creation privileges and manual rule reload. The vulnerability is fixed in versions 7.0.16 and 8.0.5; workarounds include preprocessing rules to strip absolute paths, using privilege dropping to limit writable files, or configuring landlock restrictions.

Affected products

OISF Suricata before 7.0.16 and 8.0.5

Timeline

2026-05-19: disclosed
2026-05-19: patched: Fixed in versions 7.0.16 and 8.0.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.