CISA Sounds Alarm on Critical Sudo Flaw Actively Exploited in Linux and Unix Systems

According to CISA, the U.S. Cybersecurity and Infrastructure Security Agency, the Known Exploited Vulnerabilities catalog has added a critical flaw in the Sudo command-line utility, CVE-2025-32463 (CVSS 9.3), affecting Sudo versions prior to 1.9.17p1. The vulnerability was disclosed by Rich Mirch of Stratascale back in July 2025. CISA described it as enabling a local attacker to leverage sudo's -R (chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file.

The agency notes that it is currently not known how the shortcoming is being exploited in real-world attacks or who might be behind such efforts, and it adds four other flaws to KEV with brief disclosures for each. In light of active exploitation, FCEB agencies relying on the affected products are advised to apply the necessary mitigations by 20 October 2025 to secure their networks.