Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control.
Priority
MEDIUM
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-08-17 | 1 | PoC1 |
| 2026-09-12 | 1 | Patch1 |
🚨 HIGH: CVE-2026-63622 (CVSS 7.8) - libvirt symlink vulnerability allows privilege escalation from swtpm sandbox to root. Local attacker can gain root-level file ownership control. Patch immediately. #CVE #Vulnerability #PatchNow https://t.co/sLm7oUhffJ
Post summary
The tweet warns of CVE-2026-63622—a libvirt symlink privilege escalation flaw—urging users to patch immediately to prevent root-level exploitation.
https://skypoc.wordpress.com/2026/08/12/cve-2026-63622/
Post summary
The skypoc.com post appears to supply a proof‑of‑concept for CVE‑2026‑63622, detailing the flaw and providing code, but does not mention active exploitation, patches, or a false‑positive claim.