The vulnerability CVE-2026-35535 in Sudo through version 1.9.17p2 before commit 3e474c2 involves improper handling of failures in privilege dropping system calls (setuid, setgid, setgroups) before executing the mailer. These failures are not treated as fatal errors, which can result in privilege escalation. The issue is tracked under CWE-271 (Privilege Dropping / Lowering Errors) and CWE-272 (Least Privilege Violation). Red Hat has published multiple advisories and errata providing patches and updates for affected versions, particularly for Red Hat Enterprise Linux 6 Extended Lifecycle Support. The CVSS v3.1 base score is 7.4, indicating a high severity impact with local attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can allow a local attacker to escalate privileges due to the failure to properly handle errors in privilege dropping calls. This could lead to unauthorized access with elevated privileges, compromising system confidentiality, integrity, and availability. The vulnerability affects the sudo utility, which is widely used for delegated administrative access, increasing the potential impact on affected systems.

Red Hat has released security updates addressing CVE-2026-35535. Users of affected Red Hat Enterprise Linux 6 Extended Lifecycle Support versions should apply the provided patches as detailed in the Red Hat advisories (e.g., RHSA-2026:13896). The advisories include instructions for updating sudo packages to fixed versions. Since this is a local privilege escalation vulnerability, applying the official patches is the recommended and effective mitigation. Patch status is confirmed by Red Hat advisories; therefore, updating to the fixed versions resolves the issue.