Organizations Warned of Exploited Sudo Vulnerability

According to CISA, a recently patched local privilege escalation vulnerability in Sudo has been exploited in the wild. The flaw, tracked as CVE-2025-32463 with a CVSS score of 9.3, allows any user to run commands with root privileges on systems that support /etc/nsswitch.conf. Exploitation hinges on a user creating an /etc/nsswitch.conf file in a root directory and using chroot to trick Sudo into loading it.

The bug was introduced in 2023 in Sudo version 1.9.14 and was resolved in June with the release of Sudo 1.9.17p1, which deprecated the chroot feature and removed the option to run commands with a user-selected root directory. CISA added CVE-2025-32463 to KEV and urged affected federal agencies to address it within three weeks, though PoCs have been available since July.

The agency also updated KEV to include three other disclosed vulnerabilities in Cisco IOS/IOS XE, Fortra GoAnywhere MFT, and Libraesva Email Security Gateway, all marked as exploited last week.