PatchTheCVECVE-2023-26604: systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., pl
CVE-2023-26604 is a high-severity flaw (CVSS 7.8) affecting debian linux, systemd. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl status" command may be executed. Specifically, systemd does not set LESSSECURE to 1, and thus other programs may be launched from the less program. This presents a substantial security risk when running systemctl from Sudo, because less executes as root when the terminal size is too small to s
Why this priority
- High severity
- Public exploit reference
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.8 (High) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 1.1% (top 36%) |
| CISA exploited list | No |
| Weakness | CWE-269 |
| Published | 2023-03-03 |
| Last modified | 2026-10-14 |
Last updated 2026-10-14 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2023-26604?
debian linux: mitigate or apply the listed mitigation; systemd: upgrade to 246.7. Exact commands for each OS are on this page.
Is CVE-2023-26604 being exploited?
CVE-2023-26604 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2023-26604 affect?
CVE-2023-26604 affects debian linux, systemd. Severity is high (CVSS 7.8). systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl status" command may be executed. Specifically, systemd does not set LESSSECURE to 1,
How urgent is CVE-2023-26604?
Priority 53/100. High severity; Public exploit reference; On your watchlist
Software pages
Debian vulnerabilities · Sudo vulnerabilities
Related CVEs
- CVE-2023-4194 MEDIUM 5.5 UPGRADE MITIGATE A flaw was found in the Linux kernel's TUN/TAP functionality
- CVE-2023-5197 HIGH 7.8 MITIGATE UPGRADE A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achiev
- CVE-2023-1077 HIGH 7.0 UPGRADE MITIGATE In the Linux kernel, pick_next_rt_entity() may return a type confused entry, not detected by the BUG_ON condit
- CVE-2022-48560 HIGH 7.5 UPGRADE MITIGATE A use-after-free exists in Python through 3.9 via heappushpop in heapq.
- CVE-2022-36280 MEDIUM 6.3 UPGRADE MITIGATE An out-of-bounds(OOB) memory access vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_kms.