CVE-2026-8933

highpriority · track · 10EPSS 0.002 · 7 %ileexploit · PoCDEEU

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

2 exploits · PoC

Likely / severe?

0.18% (7th) EPSS

CVSS 7.8 · high

Is it mine?

17 products

Check your exposure

Who says so?

3 sources

cnnvd · enisa_euvd · cert_bund

EPSS · scored 2026-10-27

A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally by Canonical snapd to construct the secure execution environment for snap applications. This vulnerability uniquely affects versions of snap-confine configured with set-capabilities (rather than standard set-uid-root installations). Due to a flaw in how privilege boundaries or security sandboxes are initialized when the binary runs under limited ambient capabilities, a local, unprivileged attacker can exploit this behavior to bypass intended restrictions and execute arbitrary code. Successful exploitation allows the local user to elevate their privileges to full root authority.

cvss

Technical severity, 0–10. One row per scoring source.

7.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · security@ubuntu.comexploitability 1.8 · impact 5.9

v3.17.4highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Psecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-250US

exploits (2)

Public proof-of-concept and weaponised exploit code.

songzzzz/CVE-2026-8933songzzzz/CVE-2026-8933PoC · poc_in_github
yifengchen-cc/CVE-2026-8933yifengchen-cc/CVE-2026-8933PoC · poc_in_github

affected products (17)

Products and version ranges known to be affected.

Canonical Snap <2.76.1all versionscert_bundDE
Ubuntu Linux Bionic snapd <2.61.4ubuntu0.18.04.1+esm4all versionscert_bundDE
Ubuntu Linux Focal snapd <2.67.1+20.04ubuntu1~esm3all versionscert_bundDE
Ubuntu Linux Jammy snapd <2.76+ubuntu22.04.1all versionscert_bundDE
Ubuntu Linux Noble snapd <2.76+ubuntu24.04.1all versionscert_bundDE
Ubuntu Linux Resolute snapd <2.76+ubuntu26.04.3all versionscert_bundDE
Ubuntu Linux Xenial snapd <2.61.4ubuntu0.16.04.1+esm4all versionscert_bundDE
Canonical snap< 2.76.1cert_bundDE
Ubuntu Linux≤ Bionic snapd <2.61.4ubuntu0.18.04.1+esm4cert_bundDE
Ubuntu Linux≤ Focal snapd <2.67.1+20.04ubuntu1~esm3cert_bundDE
Ubuntu Linux≤ Jammy snapd <2.76+ubuntu22.04.1cert_bundDE
Ubuntu Linux≤ Noble snapd <2.76+ubuntu24.04.1cert_bundDE
Ubuntu Linux≤ Resolute snapd <2.76+ubuntu26.04.3cert_bundDE
Ubuntu Linux≤ Xenial snapd <2.61.4ubuntu0.16.04.1+esm4cert_bundDE
Canonical Ubuntu 22.04 LTS< 2.76+ubuntu22.04.1enisa_euvdEU
Canonical Ubuntu 24.04 LTS< 2.76+ubuntu24.04.1enisa_euvdEU
Canonical Ubuntu 26.04 LTS< 2.76+ubuntu26.04.3enisa_euvdEU

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-2469snapd: Mehrere SchwachstellenDeutsch2026-07-21csaf · cert_bundDE
Ein lokaler Angreifer kann mehrere Schwachstellen in Ubuntu Linux und Canonical Snap ausnutzen, um Informationen offenzulegen, Root-Rechte zu erlangen und Sicherheitsmaßnahmen zu umgehen.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund NVD CVE.org MITRE

published 2026-07-21modified 2026-07-22

references (3)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan