The U.S. Cybersecurity and Infrastructure Safety Company (CISA) on Monday added a crucial safety flaw impacting the Sudo command-line utility for Linux and Unix-like working techniques to its Identified Exploited Vulnerabilities (KEV) catalog, citing proof of energetic exploitation within the wild.
The vulnerability in query is CVE-2025-32463 (CVSS rating: 9.3), which impacts Sudo variations previous to 1.9.17p1. It was disclosed by Stratascale researcher Wealthy Mirch again in July 2025.
“Sudo incorporates an inclusion of performance from an untrusted management sphere vulnerability,” CISA stated. “This vulnerability may permit an area attacker to leverage sudo’s -R (–chroot) choice to run arbitrary instructions as root, even when they aren’t listed within the sudoers file.”
It is presently not identified how the shortcoming is being exploited in real-world assaults, and who could also be behind such efforts. Additionally added to the KEV catalog are 4 different flaws –
- CVE-2021-21311 – Adminer incorporates a server-side request forgery vulnerability that, when exploited, permits a distant attacker to acquire probably delicate data. (Disclosed as exploited by Google Mandiant in Could 2022 by a risk actor referred to as UNC2903 to focus on AWS IMDS setups)
- CVE-2025-20352 – Cisco IOS and IOS XE comprise a stack-based buffer overflow vulnerability within the Easy Community Administration Protocol (SNMP) subsystem that would permit for denial of service or distant code execution. (Disclosed as exploited by Cisco final week)
- CVE-2025-10035 – Fortra GoAnywhere MFT incorporates a deserialization of untrusted information vulnerability that enables an actor with a validly solid license response signature to deserialize an arbitrary actor-controlled object, probably resulting in command injection. (Disclosed as exploited by watchTowr Labs final week)
- CVE-2025-59689 – Libraesva E-mail Safety Gateway (ESG) incorporates a command injection vulnerability that enables command injection through a compressed e-mail attachment. (Disclosed as exploited by Libraesva final week)
In gentle of energetic exploitation, Federal Civilian Govt Department (FCEB) companies counting on the affected merchandise are suggested to use the mandatory mitigations by October 20, 2025, to safe their networks.
