CISA SOUNDS ALARM ON CRITICAL SUDO FLAW ACTIVELY EXPLOITED IN LINUX AND UNIX SYSTEMS

Summary from the TLDR InfoSec newsletter

CISA added CVE-2025-32463, a critical sudo vulnerability with a CVSS score of 9.3, to its Known Exploited Vulnerabilities catalog due to evidence of active exploitation in the wild. The flaw affects sudo versions before 1.9.17p1 and allows local attackers to leverage the --chroot option to execute arbitrary commands as root, even without sudoers file permissions. Federal agencies must patch by October 20, while organizations should immediately update sudo to version 1.9.17p1 or later to prevent privilege escalation attacks.