Skip to main content

VSA-2026-051: Multiple Sudo vulnerabilities

Published Updated Severity CVSS 4.0 Affected products
2026-11-03 2026-11-03 🟢 Low Not available yet - XCP-ng 8.3 / Xen Orchestra Appliance
info

Several vulnerabilities have been discovered in Sudo, the setuid-root command execution utility that ships in the control domain (dom0) of XCP-ng and in the Xen Orchestra Appliance. For Vates products, we classify the overall impact as Low, because every one of these issues requires a local, authenticated user on a management component. For details on how we assign severity levels, see our Severity Levels Explained page.

Summary​

On XCP-ng, sudo runs in the dom0 (control domain). On the Xen Orchestra Appliance, sudo runs in the appliance OS. Four separate vulnerabilities affect sudo. Each is described below, followed by the impact on Vates products, the affected versions, the mitigation and the resolution.

CVE-2026-96512​

A local user can shift the NOTBEFORE/NOTAFTER time window of a sudoers rule by up to about 25 hours, so an expired rule is treated as still valid, or a future rule becomes valid early. Authentication is not bypassed. See the report on oss-security for the technical details.

CVE-2026-35535​

A failure of the privilege drop performed before sudo runs the mailer was not treated as a fatal error, so the mailer could be executed with elevated privileges. Qualys demonstrated a full local privilege escalation to root using this fail-open behavior. See the Qualys advisory for the technical details.

CVE-2025-32462​

The -h (--host) option was not restricted to listing privileges, so the host field of a sudoers rule is ignored and a user listed in sudoers for another host can run commands as root on the current host. See the upstream advisory for the technical details.

CVE-2025-32463​

The -R (--chroot) option can be abused to make sudo load an arbitrary shared library, leading to the execution of arbitrary commands as root, even for a user not listed in the sudoers file. See the upstream advisory for the technical details.

Impact​

All four vulnerabilities require a local, authenticated user on the affected system, and two of them (CVE-2026-96512 and CVE-2025-32462) additionally require a sudoers entry. An adversary controlling an unprivileged user could elevate their privileges, potentially leading to a total compromise of dom0 or the appliance OS. We therefore classify the overall impact as Low.

Status​

  • XCP-ng 8.3: Released
  • Xen Orchestra Appliance: In progress

Affected Versions​

  • XCP-ng 8.3: Affected.
  • Xen Orchestra Appliance: Affected.

Mitigation​

To reduce the risk of exploitation before applying the fix, restrict sudo use in the control domain and on the appliance:

  • Prefer explicit, least-privilege sudoers rules over broad grants, in /etc/sudoers and the snippets under /etc/sudoers.d/.
  • Do not use the deprecated -R (--chroot) option.
  • Where sudoers rules use time restrictions, express the timestamps in UTC, ending with Z.

No mitigation removes the need for the fix. Applying the updated package is required.

Resolution​

As of 2026-11-03, the sudo package for XCP-ng 8.3 has been updated to fix all four vulnerabilities. On the Xen Orchestra Appliance, which ships Debian 12 (bookworm), the fixes come from the Debian sudo package, but their availability differs per CVE, as shown in the list below.

List of packages fixing this issue:

  • XCP-ng 8.3:
    • sudo-1.9.17-10.p2.1.xcpng8.3 fixes all four CVEs
  • Xen Orchestra Appliance (Debian 12 sudo package):
    • CVE-2025-32462 and CVE-2025-32463: 1.9.13p3-1+deb12u2, delivered through the bookworm security updates and applied automatically by unattended-upgrades
    • CVE-2026-35535: 1.9.13p3-1+deb12u4, available in the bookworm repository
    • CVE-2026-96512: no fixed bookworm package as of 2026-11-03

Credits​

  • CVE-2026-96512: Thanks to Ermenson Junior for his upstream report.
  • CVE-2026-35535: Upstream report by ZeroPath AI Security Engineer.
  • CVE-2025-32462 & CVE-2025-32463: Thanks to Rich Mirch from Stratascale Cyber Research Unit for his upstream report.

References​