{"id":"CVE-2026-76524","kind":"vulnerability","aliases":["CVE-2026-76524"],"related":[],"title":"Snort 3: local control socket lets low-privilege users run commands","description":"A vulnerability in the control channel socket implementation of Open Source Snort 3 could allow an authenticated, local attacker with low privileges to execute arbitrary commands as the Snort 3 process user.\r\n\r\nThis vulnerability is due to a lack of authentication when a local user connects to the Snort control channel socket. An attacker could exploit this vulnerability by connecting to the Snort 3 control channel socket as a local user. A successful exploit could allow the attacker to execute arbitrary commands as well as read and write Snort 3 process memory.","summary":"Snort 3's control channel socket does not check authentication for local connections. A local user with low privileges can connect to it and run arbitrary commands as the Snort 3 process user, and read and write its memory.","severity":"high","cvss":7.8,"epss":0.00136,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux","network-security","package","snort"],"not_affected_if":["no-local-untrusted-users","snort-not-installed"],"how_to_check":"- Run `snort --version` to see the installed Snort 3 version.\n- Check whether the control channel socket is present and who can connect to it (unknown: the sources do not name the socket path or permissions).","fix":"- Upgrade Open Source Snort 3 to a fixed release (unknown: the sources do not name the fixed version).\n- Restrict local access to the Snort control channel socket until patched (unknown: the sources do not give the exact setting).","status":"open","published_at":"2026-10-21T17:19:09+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:08:20+00:00","updated_at":"2026-10-25T03:08:20+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:08:20Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Open Source Snort 3 to a fixed release (unknown: the sources do not name the fixed version).\n- Restrict local access to the Snort control channel socket until patched (unknown: the sources do not give the exact setting).","reach":"local","title":"Snort 3: local control socket lets low-privilege users run commands","impact":"high","summary":"Snort 3's control channel socket does not check authentication for local connections. A local user with low privileges can connect to it and run arbitrary commands as the Snort 3 process user, and read and write its memory.","category":"package","nicknames":[],"who_cares":["snort","network-security","linux"],"confidence":0.6,"needs_auth":"yes","worst_case":"Local attacker runs commands as the Snort process user","analyst_note":"Find the fixed Snort 3 version and the control socket path/permissions in the NVD entry or the vendor advisory for CVE-2026-76524.","how_to_check":"- Run `snort --version` to see the installed Snort 3 version.\n- Check whether the control channel socket is present and who can connect to it (unknown: the sources do not name the socket path or permissions).","needs_analyst":true,"not_affected_if":["snort-not-installed","no-local-untrusted-users"],"who_is_affected":"Hosts running Open Source Snort 3 where local, non-privileged users or processes can reach the control channel socket. Systems without Snort 3, or where only trusted administrators have local shell access, face lower practical risk. Remote attackers are not described as able to exploit this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000625,"input_tokens":3438,"output_tokens":563,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-76524':15A,18A '3':2A,26B,55B,76C,93C,127C,153C 'allow':78C,139C 'arbitrari':50B,88C,144C 'attack':82C,117C,141C 'authent':34B,80C,104C 'channel':29B,69C,114C,129C 'check':33B 'command':12A,51B,89C,145C 'connect':37B,45B,109C,123C 'control':4A,28B,68C,113C,128C 'could':77C,118C,138C 'cve':13A,16A 'due':99C 'execut':87C,143C 'exploit':119C,137C 'implement':71C 'lack':102C 'let':6A 'linux':19B 'local':3A,36B,39B,81C,107C,133C 'low':8A,42B,84C 'low-privileg':7A 'memori':63B,155C 'network':21B 'network-secur':20B 'open':73C 'packag':23B 'privileg':9A,43B,85C 'process':56B,94C,154C 'read':59B,149C 'run':11A,49B 'secur':22B 'snort':1A,24B,25B,54B,75C,92C,112C,126C,152C 'socket':5A,30B,70C,115C,130C 'sourc':74C 'success':136C 'user':10A,40B,57B,95C,108C,134C 'vulner':65C,97C,121C 'well':147C 'write':61B,151C","nicknames":[],"mitigations":[],"who_affected":"Hosts running Open Source Snort 3 where local, non-privileged users or processes can reach the control channel socket. Systems without Snort 3, or where only trusted administrators have local shell access, face lower practical risk. Remote attackers are not described as able to exploit this.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T17:19:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76524","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76524","severity":null,"published_at":"2026-10-21T17:19:09+00:00","modified_at":"2026-10-22T14:17:49+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-76524","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76524","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}