CVE-2026-76524: Open Source Snort 3 Control Channel Socket Aribitrary Command Execution Vulnerability
A vulnerability in the control channel socket implementation of Open Source Snort 3 could allow an authenticated, local attacker with low privileges to execute arbitrary commands as the Snort 3 process user. This vulnerability is due to a lack of authentication when a local user connects to the Snort control channel socket. An attacker could exploit this vulnerability by connecting to the Snort 3 control channel socket as a local user. A successful exploit could allow the attacker to execute arbitrary commands as well as read and write Snort 3 process memory.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Systems running Open Source Snort 3 are exposed if a local low-privileged authenticated user can connect to the Snort control channel socket. The issue is locally exploitable; the provided data does not indicate remote exploitation.
What level of access does an attacker need?
An attacker needs authenticated local access with low privileges and the ability to connect to the Snort control channel socket. No user interaction is required.
What could a successful attacker do?
A successful attacker can execute arbitrary commands as the Snort 3 process user. They may also read and write the Snort 3 process memory.