Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2025-10-20. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
13 versions affected across 8 products
| Date | Total | Labels |
|---|
| 2026-02-04 | 2 | Patch2 |
| 2026-02-12 | 2 | General1Patch1 |
| 2026-03-07 | 1 | PoC1 |
| 2026-03-30 | 1 | General1 |
| 2026-04-13 | 1 | General1 |
| 2026-05-01 | 1 | Patch1 |
| 2026-05-20 | 3 | Patch1PoC2 |
| 2026-06-22 | 1 | PoC1 |
| 2026-07-02 | 1 | Exploit1 |
o-based exploit tool for CVE-2025-32463, a critical local privilege escalation vulnerability (CVSS 9.3) in sudo versions 1.9.14 to 1.9.17. https://github.com/Nowafen/CVE-2025-32463
Post summary
An exploit tool for CVE-2025-32463, a critical LPE in sudo, has been released on GitHub; no active exploitation or patch info is provided.
GitHub - Nowafen/CVE-2025-32463: This CVE addresses a vulnerability in sudo versions 1.9.14 to 1.9.17, enabling unauthorized local privilege escalation to root access. · GitHub https://github.com/Nowafen/CVE-2025-32463
Post summary
The GitHub repo provides a proof‑of‑concept for CVE‑2025‑32463, a sudo local privilege escalation flaw, with no evidence of active exploitation or patch availability.
@elormkdaniel This is old from 2025, CVE-2025-32463, and has been patched in sudo 1.9.15p5-3ubuntu5.24.04.1: https://ubuntu.com/security/CVE-2025-32463
Post summary
The tweet references CVE-2025-32463 and confirms it has been patched, offering a link to the vendor advisory for details.
@elormkdaniel @nyxgeek https://github.com/K1tt3h/CVE-2025-32463-POC
Post summary
The tweet references a GitHub repository named CVE-2025-32463-POC, indicating that a proof‑of‑concept exploit script is publicly available, with no mention of active exploitation, patches, or detailed technical information.
@utdream @elormkdaniel https://github.com/K1tt3h/CVE-2025-32463-POC/blob/main/CVE-2025-32463-POC.sh
Post summary
A tweet links to a GitHub proof‑of‑concept script for CVE‑2025‑32463, with no indication of active exploitation, patch deployment, or debunking.
🚨 CVE-2025-32463 - critical 🚨 Sudo - Local Privilege Escalation via chroot > Sudo before 1.9.17p1 allows local users to obtain root access by using /etc/nsswitch.... 👾 https://cloud.projectdiscovery.io/library/CVE-2025-32463 @pdnuclei #NucleiTemplates #cve
Post summary
The tweet announces CVE-2025-32463, a critical local privilege escalation in older Sudo versions (<1.9.17p1) using /etc/nsswitch, but does not provide exploit code, active use evidence, or patch information.
@gaxeliy @Wandrovik Также уязвимости Linux (я что вам какая то шутка ) CVE-2025-38561, CVE-2025-6018, CVE-2025-6019, CVE-2025-32463, CVE-2026-24061
Post summary
The text simply lists several Linux CVE identifiers without providing additional context, technical details, or actionable information.
@LundukeJournal https://nvd.nist.gov/vuln/detail/cve-2025-32463 Probably there for up to 10 years until a patch was released in jan 2025. Yet to this day, many system remained vulnerable. But posting CVEs with impressive names sure produces engagement : I myself got baited.
Post summary
The tweet references CVE-2025-32463 and notes that a patch was released in January 2025, yet many systems remain vulnerable.
@ljachowicz . wszystko tu można wymyślić ale sam widzisz ilości stwierdzeń warunkowych, a ja mam na myśli jedynie fakt, żeby być w miarę precyzyjnym w naganianiu tej paniki… to lokalna klapa porównywalna w skutkach do CVE-2021-3156 albo CVE-2025-32462/CVE-2025-32463 i wystarczy zpatchować
Post summary
The comment highlights a vulnerability (referencing CVE‑2021‑3156 and CVE‑2025‑32462/32463) and stresses that simple patching will mitigate it.
@lcfr_eth Not a single privilege escalation on Linux since 2010 ? Not even CVE-2025-32463 ?
Post summary
The tweet asks whether CVE‑2025‑32463 is a privilege‑escalation flaw on Linux but gives no technical or exploit information.
【結論】sudo脆弱性（CVE-2025-32463）は、まずアップデートが最優先です。 sudo 1.9.17p1より前が影響範囲とされていて、ローカルユーザーからroot権限に繋がる可能性があります（出典：NVD 2025/06/30）。 ※深刻度は評価元により表記が分かれます（CNA評価でCVSS 9.3、NVD側では7.8表記もあり）。 ■ まず確認するなら、これだけ（保存版） 1) sudo -V でバージョン確認 2) 修正版へ更新（RHEL系は dnf/yum、Debian系は apt） 3) 事前に仮想環境で試す（壊してもいい環境だと気が楽になります） ■ NG（これをやると危険です） ・ バージョン確認せずに放置する ・ 本番環境でいきなり更新する ・ 更新後の動作確認を省略する ポイントは「学ぶ順番」です。 先に安全な環境で手順を試す → それから本番に適用、これが最適なステップアップです。 安全な環境が作れる無料マニュアルのリンクは、次のリプに置いてあります。
Post summary
The post highlights CVE-2025-32463, provides technical details of the local privilege escalation risk, and focuses on the need for immediate patching via standard package managers.
多くの人が勘違いしてるのは、sudo脆弱性を「自分には関係ない」と考えてる点です。 実際、Verizonの2025 DBIRでは「脆弱性の悪用」が初期侵入で使われる割合が前年比34%増えたと報告されています（出典：Verizon DBIR 2025/04/23）。 sudoにも複数の脆弱性（例：CVE-2025-32462 / CVE-2025-32463）が報告され、ローカル環境から権限昇格につながる可能性があるものもあります。 ※対象は「sudo 1.9.17p1 未満」（出典：NVD 2025/06/30 ほか） 難しく感じるかもしれませんが、やることは簡単です。 「壊しても誰にも迷惑が掛からない環境」で、手順通りに実行するだけです。 もし、試すならこれだけでOKです。 1) AlmaLinuxの仮想環境を立てる（壊してOK） 2) sudo -V でバージョン確認 3) 古いバージョンなら更新コマンドを実行（例：RHEL系は dnf update sudo） 手順通りにやるだけで、いつでも試せる環境が作れれば 本番サーバーを触る前に、「安全な場所で手を動かす経験」が積めます。それがあるかないかで、現場での対応速度がまるで違います。 そんな環境が作れる無料マニュアルのリンクは、次のリプに置いてあります。
Post summary
The post announces newly disclosed sudo CVEs that enable local privilege escalation and recommends updating sudo to mitigate the risk.
New HackTheBox walkthrough: Expressway UDP enumeration → IPsec IKE aggressive mode → PSK cracking → CVE-2025-32463 sudo privilege escalation. VPN pentesting meets modern privesc. https://youtu.be/RsoQJJvo8Is #HackTheBox #VPN #IPsec https://t.co/EGVviOTnEE
Post summary
The post shares a video walkthrough demonstrating how CVE-2025-32463 can be leveraged for privilege escalation via IPsec IKE PSK cracking, serving as a proof‑of‑concept. There is no mention of active exploitation, patches, or debunking.
18 of 18 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | canonical | ubuntu_linux | 22.04 | - | - |
| OS | canonical | ubuntu_linux | 24.04 | - | - |
| OS | canonical | ubuntu_linux | 24.10 | - | - |
| OS | canonical | ubuntu_linux | 25.04 | - | - |
| OS | debian | debian_linux | 11.0 | - | - |
| OS | debian | debian_linux | 12.0 | - | - |
| OS | debian | debian_linux | 13.0 | - | - |
| OS | opensuse | leap | 15.6 | - | - |
| OS | redhat | enterprise_linux | 10.0 | - | - |
| App | sudo_project | sudo | - | - | - |
| App | sudo_project | sudo | 1.9.17 | - | - |
| OS | suse | linux_enterprise_desktop | 15 | - | - |
| OS | suse | linux_enterprise_desktop | 15 | - | - |
| OS | suse | linux_enterprise_real_time | 15.0 | - | - |
| OS | suse | linux_enterprise_real_time | 15.0 | - | - |
| OS | suse | linux_enterprise_real_time | 15.0 | - | - |
| OS | suse | linux_enterprise_server_for_sap | 12 | - | - |
| OS | suse | linux_enterprise_server_for_sap | 12 | - | - |