CVE-2026-82474: Sudo lets users run blocked programs on Linux

On Linux systems, the sudo tool up to version 1.9.17p2 can be tricked to run programs that administrators have said should be blocked. This means a user who is supposed to run only certain approved commands could start any other program without the usual warning or record, potentially creating a security risk. The fix is to upgrade sudo to a newer version and review who has sudo rights.

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

• https://github.com/sudo-project/sudo Product
• https://github.com/sudo-project/sudo/blob/v1.9.17p2/src/exec_ptrace.c Third Party Advisory
• https://github.com/sudo-project/sudo/commit/71fbe42dcd5a1c8f799540583a2dfb2ae622... Patch
• https://www.vulncheck.com/advisories/sudo-through-1.9-17p2-intercept-policy-bypa... Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-82474 Vendor Advisory
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82474... Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-82474 Vendor Advisory