CVE-2026-45767 OISF CVE debrief

Who should care

Network security teams using Suricata for intrusion detection and prevention, as well as teams responsible for vulnerability management and security monitoring. These teams should assess their exposure, verify rule configurations, and consider upgrading to versions 7.0.16 or 8.0.5. The vulnerability allows a malicious rule to overwrite files on the system, potentially leading to privilege escalation and system compromise.

Why it matters

This vulnerability in Suricata could allow a malicious rule to overwrite any file on the file system, potentially leading to privilege escalation and system compromise. Network security teams using Suricata should assess their exposure, verify rule configurations, and consider upgrading to versions 7.0.16 or 8.0.5. The vulnerability has a medium CVSS score of 4.4.

• Potential file overwrite on rule load or reload
• Possible privilege escalation through malicious rules
• Need for immediate upgrade or mitigation
• Verification of rule configurations and file system permissions required

Technical summary

A malicious rule could potentially overwrite any file on the file system on rule load or reload in Suricata versions prior to 7.0.16 and 8.0.5. This vulnerability allows for potential privilege escalation and system compromise. The issue is addressed in versions 7.0.16 and 8.0.5. Network security teams using Suricata should assess their exposure and consider upgrading to a fixed version. The vulnerability has a medium CVSS score of 4.4, indicating a moderate severity level. The CVE record and NVD entry provide details on the vulnerability.

Defensive priority

Medium priority for systems using Suricata versions prior to 7.0.16 or 8.0.5

Recommended defensive actions

• Upgrade to Suricata version 7.0.16 or 8.0.5
• Preprocess 'load' + 'save' rules to disallow absolute filenames for save
• Use Suricata's privilege dropping to limit writable files
• Configure landlock in suricata.yaml
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, while additional information is available from Suricata's community forum and GitHub advisories. The vulnerability allows a malicious rule to overwrite files on the system, potentially leading to privilege escalation and system compromise. Network security teams should verify rule configurations and file system permissions. The CVE record was published on 2026-09-10T22:16:56.683Z and has not been modified since then. Suricata's community forum and GitHub advisories can

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.