Is CVE-2026-82474 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82474 being exploited in the wild.

How severe is CVE-2026-82474?

High severity, with a CVSS score of 7.8, published 29 August 2026.

Which products and versions are affected?

Sudo Project Sudo through 1.9.17p2.

Is there a fix for CVE-2026-82474?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-82474 attacked?

It is attacked with local access.

Am I affected by CVE-2026-82474?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82474: Sudo ptrace intercept bypass via execveat

CVE-2026-82474 · Severity: high · CVSS 7.8 · Published 2026-08-29

Sudo, a widely-used utility for running commands with elevated privileges, fails to enforce access controls when users invoke the execveat system call in ptrace-based monitoring mode. An attacker with permission to run specific commands can bypass policy restrictions and execute denied programs, circumventing logging and audit controls that organizations rely on to enforce least-privilege access.

Quick answers

Is CVE-2026-82474 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82474 being exploited in the wild.
How severe is CVE-2026-82474?: High severity, with a CVSS score of 7.8, published 29 August 2026.
Which products and versions are affected?: Sudo Project Sudo through 1.9.17p2.
Is there a fix for CVE-2026-82474?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-82474 attacked?: It is attacked with local access.
Am I affected by CVE-2026-82474?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a privilege escalation flaw in Sudo's ptrace-based intercept mode. The flaw exists in the exec_ptrace.c component, where policy checks are not applied to the execveat system call (and by extension, fexecve, which uses execveat internally). An authenticated user permitted to run certain commands can invoke execveat or fexecve to execute programs that the policy denies, bypassing the intercept policy enforcement and audit logging. The attack requires local access and that the attacker be already permitted to run some sudo commands. A patch is expected in versions after 1.9.17p2.

Affected products

Sudo Project Sudo through 1.9.17p2

Timeline

2026-08-29: disclosed
other: Known CVE as of publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.