CISA Issues Alert on Active Exploitation of Linux and Unix Sudo Flaw

According to CISA, the Cybersecurity and Infrastructure Security Agency, researchers have confirmed that attackers are actively exploiting a serious vulnerability in the sudo utility used on many Linux and Unix systems, tracked as CVE-2025-32463. The flaw could allow a local attacker with limited sudo access to run commands as root outside the sudoers list, bypassing normal permission checks.

Active exploitation has been observed in several targeted attacks, though there is no public evidence tying it to large-scale campaigns, and CISA rates the issue as high priority due to the risk of full system compromise.

Organizations have until 20 October 2025 to apply mitigations or document an approved risk acceptance plan, with guidance including identifying vulnerable systems, applying vendor patches, following Binding Operational Directive 22-01 for cloud services, and considering temporary workarounds such as disabling the –R/–chroot option or restricting sudo access. The alert also emphasises monitoring logs for unusual sudo usage and testing updates in non-production environments before broad rollout.