Skip to content
Threat Feed
critical advisory

Ubuntu 24.04 Snapd Local Privilege Escalation (CVE-2026-3888)

CVE-2026-3888 allows a local attacker to escalate privileges to root on Ubuntu 24.04 systems due to a vulnerability in the snapd service.

A local privilege escalation vulnerability, identified as CVE-2026-3888, affects Ubuntu 24.04 installations due to a flaw within the snapd service. This vulnerability allows a malicious local user to gain root privileges on a vulnerable system. The Qualys Research Team discovered and reported the vulnerability on March 17, 2026. Defenders should prioritize patching vulnerable systems to prevent potential exploitation. The vulnerability’s impact is significant, as successful exploitation grants…

Detection coverage 2

Detect Suspicious Snap Package Installation

high

Detects attempts to install snap packages from unusual locations, potentially indicating exploitation of CVE-2026-3888.

sigma tactics: privilege_escalation techniques: T1068 sources: process_creation, linux

Detect Snapd Spawning Root Shell

critical

Detects snapd spawning a shell as root, which can indicate privilege escalation.

sigma tactics: privilege_escalation techniques: T1068 sources: process_creation, linux

Detection queries are kept inside the platform. Get full rules →