snap-confine local privilege escalation to root
snap-confine flaw on Ubuntu lets an unprivileged local user gain root on default Desktop 24.04, 25.10, and 26.04 installs. CVSS 7.8 high.
- Vendor
- Canonical
- Product
- snap-confine (Ubuntu Desktop 24.04 LTS, 25.10, 26.04)
- CVSS
- 7.8
- EPSS (exploit probability)
- 0.2%
- Status
- unpatched
- Published
Is CVE-2026-8933 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-8933 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-05 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.2% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-05. Full cross-catalog view: /kev-comparison
CVE-2026-8933 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
A local privilege escalation vulnerability in snap-confine, the setuid-root binary that sets up AppArmor confinement for snap packages on Ubuntu, allows an unprivileged local user to obtain root access. The flaw affects default installations of Ubuntu Desktop 24.04 LTS, 25.10, and 26.04.
Mechanism: snap-confine runs with elevated privileges by design — configuring filesystem namespaces and AppArmor profiles requires root. A flaw in how it handles its execution path allows an unprivileged caller to subvert that elevated execution and obtain root on the host.
Exploitation: Local access required. No network exposure. The attacker must have an unprivileged shell account on the affected system.
Impact: Full local root. An attacker with any local account on a default Ubuntu Desktop installation can escalate to root via this vulnerability.
Affected versions: Ubuntu Desktop 24.04 LTS, 25.10, 26.04 — any default installation with snap present.
Patch: Monitor Ubuntu Security Notices for the CVE-2026-8933 advisory. Once published, update the snapd package via sudo apt update && sudo apt upgrade snapd. Ubuntu Server installations without snap installed are not affected.
Sources: NVD | The Hacker News
