CVE catalog

CVE-2023-26604

systemd: CVE-2023-26604

[CVE catalog]

Severity
High · CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.05% · Oct 25, 2026

systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl status" command may be executed. Specifically, systemd does not set LESSSECURE to 1, and thus other programs may be launched from the less program. This presents a substantial security risk when running systemctl from Sudo, because less executes as root when the terminal size is too small to show the complete systemctl output.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiansystemdsid262.1-1fixed
Debiansystemdforky262-1fixed
Debiansystemdtrixie257.13-1~deb13u1fixed
Debiansystemdbookworm252.39-1~deb12u2fixed
Debiansystemdbookworm-security252.38-1~deb12u1fixed
Cpedebian_linuxNot reportedNot reportedunknown
CpesystemdNot reported246.7fixed
Susesystemdlinux enterprise software development kit 12 sp5228-157.52.1fixed
Susesystemdlinux enterprise server 12 sp5228-157.52.1fixed
Susesystemdlinux enterprise server for sap applications 12 sp5228-157.52.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiansystemdsourcesid247.1-2not yet assignedNot reportedNot reported
Debiansystemdsourceforky247.1-2not yet assignedNot reportedNot reported
Debiansystemdsourcetrixie247.1-2not yet assignedNot reportedNot reported
Debiansystemdsourcebookworm247.1-2not yet assignedNot reportedNot reported
CpesystemdcpeNot reported246.7Not reportedNVD-CVE-2023-26604Not reported
Susesystemdrpmlinux enterprise software development kit 12 sp5228-157.52.1Not reportedSUSE-SU-2023:1622-1Not reported
Susesystemdrpmlinux enterprise server 12 sp5228-157.52.1Not reportedSUSE-SU-2023:1622-1Not reported
Susesystemdrpmlinux enterprise server for sap applications 12 sp5228-157.52.1Not reportedSUSE-SU-2023:1622-1Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[CERT-Bund public advisories] · [CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]