USN-8701-1: UDisks vulnerability

unknownpublic exploitCVE-2026-7867

It was discovered that UDisks did not correctly validate the caller identity when handling the as-user option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. A local attacker with an active console session could possibly use this issue to mount filesystems on behalf of arbitrary users, including privileged accounts, leading to local privilege escalation.

CSIRTS triage

vendor: UDisks product: UDisks Privilege escalation Authentication bypass

What: UDisks does not correctly validate caller identity when handling the as-user option in the Filesystem.Mount() D-Bus method.
Who is affected: Local attackers with an active console session on systems running UDisks.
Urgency: High urgency; local privilege escalation allowing filesystem mounting as arbitrary users including root.
Action: Update UDisks to the patched version from USN-8701-1 fixing CVE-2026-7867.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch UDisks

Get an email when a new UDisks advisory drops — max one per day, one-click unsubscribe.

Details

Source: Ubuntu Security Notices (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-08-31
Exploitation: Not in CISA KEV at last sync

Original advisory: https://ubuntu.com/security/notices/USN-8701-1

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-78670.18% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 7% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-7867	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.