In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation.

redhat RHSA-2026:10758: RHSA-2026:10758: sudo security update (Important)

centos_stream sudo-1.9.17p2-4.el9: sudo-1.9.17p2-4.el9

The version of CBL-Mariner Releases installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2026-35535 advisory.

  - In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a     privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation.
    (CVE-2026-35535)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-6894ade78f advisory.

    Fix CVE-2026-35535

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the sudo package has been released.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:20604-1 advisory.

    - CVE-2026-35535: unhandled failure of `setuid`, `setgid` or `setgroups` calls during a mailer privilege     drop allows       for local privilege escalation (bsc#1261420).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-e860be4db8 advisory.

    Fix CVE-2026-35535

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:1359-1 advisory.

    This update for sudo fixes the following issue:

    - CVE-2026-35535: Fixed potential privilege escalation when running the mailer (bsc#1261420).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:1308-1 advisory.

    This update for sudo fixes the following issue:

    - CVE-2026-35535: Fixed potential privilege escalation when running the mailer (bsc#1261420).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:1309-1 advisory.

    This update for sudo fixes the following issue:

    - CVE-2026-35535: Fixed potential privilege escalation when running the mailer (bsc#1261420).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1559 advisory.

    In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a     privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation.
    (CVE-2026-35535)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of CBL-Mariner Releases installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2026-35535 advisory.

  - In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a     privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation.
    (CVE-2026-35535)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a     privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation.
    (CVE-2026-35535)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
310262	CBL Mariner 2.0 Security Update: CBL-Mariner Releases (CVE-2026-35535)	Nessus	MarinerOS Local Security Checks	high
310253	Fedora 44 : sudo (2026-6894ade78f)	Nessus	Fedora Local Security Checks	high
310095	Photon OS 4.0: Sudo PHSA-2026-4.0-1002	Nessus	PhotonOS Local Security Checks	high
310090	openSUSE 16 Security Update : sudo (openSUSE-SU-2026:20604-1)	Nessus	SuSE Local Security Checks	high
309857	Fedora 43 : sudo (2026-e860be4db8)	Nessus	Fedora Local Security Checks	high
306687	SUSE SLED15 / SLES15 Security Update : sudo (SUSE-SU-2026:1359-1)	Nessus	SuSE Local Security Checks	high
306503	SUSE SLES15 Security Update : sudo (SUSE-SU-2026:1308-1)	Nessus	SuSE Local Security Checks	high
306479	SUSE SLES15 Security Update : sudo (SUSE-SU-2026:1309-1)	Nessus	SuSE Local Security Checks	high
306349	Photon OS 5.0: Sudo PHSA-2026-5.0-0815	Nessus	PhotonOS Local Security Checks	high
306230	Amazon Linux 2023 : sudo, sudo-devel, sudo-logsrvd (ALAS2023-2026-1559)	Nessus	Amazon Linux Local Security Checks	high
306016	Azure Linux 3.0 Security Update: CBL-Mariner Releases (CVE-2026-35535)	Nessus	Azure Linux Local Security Checks	high
304901	Linux Distros Unpatched Vulnerability : CVE-2026-35535	Nessus	Misc.	high

Detections

Analytics

CVE-2026-35535

high

Tenable Plugins

Coming Soon

high

high

high

high

high

high

high

high

high

high

high

high