Published July 23, 2026.

CVE-2026-8933 is a local privilege-escalation flaw in snap-confine — a core snapd component — that lets an unprivileged user win a race condition and gain root on default Ubuntu Desktop installs. It is rated CVSS 7.8 and affects Ubuntu 24.04, 25.10, and 26.04; apply the latest snapd updates now.

What happened. Qualys's Threat Research Unit (researcher Saeed Abbasi) disclosed CVE-2026-8933, a local privilege escalation in snap-confine, the set-capabilities helper snapd uses to build a snap's secure execution sandbox. The exploit abuses two concurrent race conditions during sandbox setup: the attacker mounts a malicious FUSE filesystem over the temporary scratch directory the instant it is created, then plants a symbolic link that redirects snap-confine's privileged file operations to arbitrary system locations — turning a normal user session into root. It affects Ubuntu Desktop 24.04, 25.10, and 26.04, where snap is installed and used by default.

How serious is CVE-2026-8933?

It carries a CVSS 7.8 (High) rating with a local attack vector (CWE-250, execution with unnecessary privileges). NVD's EPSS score sits low, in the 4th percentile, but that metric consistently understates local-privilege-escalation bugs: this is a full root escape on a default desktop configuration, disclosed with a detailed technical mechanism by a top exploit-research team. Treat "public technique exists" as the signal, not the EPSS number.

Which Ubuntu versions are affected?

What to do now.

• Apply the latest snapd updates immediately (sudo apt update && sudo apt install --only-upgrade snapd) on every affected Ubuntu desktop and any server that runs snaps.

• Prioritise multi-user and shared machines, where a local, low-privilege account gaining root is the highest-impact.

• Confirm the snapd version after updating — a running unpatched snap-confine remains exploitable until the package is upgraded.

Who's affected. Any Ubuntu 24.04, 25.10, or 26.04 system where snapd is installed (the default), especially shared workstations, lab machines, and developer hosts where untrusted local users have accounts.

Our read. The instructive part is the exploit's shape: two races and a symlink against a sandbox-setup path — not a memory-corruption exotic, but a logic flaw in the very code meant to contain a process. NVD scores it modestly and EPSS all but ignores it, yet a reliable local-to-root primitive on the default Linux desktop is exactly the kind of bug that quietly underpins post-exploitation. Verifying that snapd is actually patched across your fleet beats trusting the severity score to tell you it's urgent.

Frequently asked questions

Can CVE-2026-8933 be exploited remotely? No — it requires local access. The risk is a low-privileged user (or a foothold from another bug) escalating to root, which is why shared and multi-user systems are the priority.

Is there a public exploit for CVE-2026-8933? Qualys published a detailed technical breakdown of the race-condition mechanism; treat a working exploit as feasible and imminent even where code is not yet widely circulated.

Which snapd version fixes it? Canonical has issued updated snapd packages across the affected releases — apply the latest available update for your Ubuntu version rather than pinning to a specific build number.

Does this affect servers or only desktops? It affects any system running snapd, but default desktop installs are the headline because snap is present and used out of the box there.

Reporting by The Hacker News; technical detail per Qualys (Saeed Abbasi). CVSS and CWE per the NVD record. Sources linked above. Related: our coverage of a Linux kernel root and container-escape flaw.