CVE-2026-45767
published 2026-09-10CVE-2026-45767: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a…
PriorityP424medium4.4CVSS 3.1
AVNACHPRHUINSUCNIHAN
EPSS
0.40%
32.9th percentile
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a malicious rule could potentially overwrite any file on the file system on rule load or reload. Versions 7.0.16 and 8.0.5 fix the issue. Some workarounds are available. Preprocess `load`+ `save` rules to disallow absolute filenames for save, use Suricata's privilege dropping to limit writable files, and/or configure landlock in suricata.yaml.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oisf | suricata | < 7.0.16 | 7.0.16 |
| oisf | suricata | — | — |
| oisf | suricata | >= 7.0.0 < 7.0.16 | 7.0.16 |
| oisf | suricata | >= 8.0.0 < 8.0.5 | 8.0.5 |
CVSS provenance
nvdv3.14.4MEDIUMCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N
vendor_redhat4.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
suricata: Suricata: File overwrite via malicious rule load
vendor_redhat·2026-09-10·CVSS 4.4
CVE-2026-45767 [MEDIUM] CWE-73 suricata: Suricata: File overwrite via malicious rule load
suricata: Suricata: File overwrite via malicious rule load
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a malicious rule could potentially overwrite any file on the file system on rule load or reload. Versions 7.0.16 and 8.0.5 fix the issue. Some workarounds are available. Preprocess `load`+ `save` rules to disallow absolute filenames for save, use Suricata's privilege dropping to limit writable files, and/or configure landlock in suricata.yaml.
A flaw was found in Suricata, a network Intrusion Detection System (IDS), Intrusion Prevention System (IPS), and Network Security Monitoring engine. A highly privileged remote attacker could exploit this vulnerability by crafting a malicio
VulDB
OISF Suricata up to 7.0.15/8.0.4 Rule suricata.yaml path traversal
vuldb·2026-09-10·CVSS 4.4
CVE-2026-45767 [MEDIUM] OISF Suricata up to 7.0.15/8.0.4 Rule suricata.yaml path traversal
A vulnerability categorized as critical has been discovered in OISF Suricata up to 7.0.15/8.0.4. This affects an unknown function of the file suricata.yaml of the component Rule Handler. Executing a manipulation can lead to path traversal.
This vulnerability is handled as CVE-2026-45767. The attack can be executed remotely. There is not any exploit available.
It is advisable to upgrade the affected component.
No detection rules found.
No public exploits indexed.
2026-09-10
Published