USN-8496-3: cifs-utils vulnerability

unknownCVE-2026-12505

USN-8496-1 fixed vulnerabilities in cifs-utils. The update caused a regression and was backed out in USN-8496-2. This update reintroduces the security fix, along with a fix for the regression. Original advisory details: It was discovered that cifs-utils incorrectly dropped root privileges before looking up user information. A local attacker could possibly use this issue to execute arbitrary code as the root user.

CSIRTS triage

vendor: cifs-utils product: cifs-utils Privilege escalation

What: cifs-utils incorrectly dropped root privileges, allowing a local attacker to execute arbitrary code as root.
Who is affected: Users of cifs-utils who have the affected version installed.
Urgency: Remediation is urgent due to the potential for privilege escalation.
Action: Update to the latest version of cifs-utils to fix this vulnerability.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch cifs-utils

Get an email when a new cifs-utils advisory drops — max one per day, one-click unsubscribe.

Details

Source: Ubuntu Security Notices (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-07-13
Exploitation: Not in CISA KEV at last sync

Original advisory: https://ubuntu.com/security/notices/USN-8496-3

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-125050.16% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 5% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-12505	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.