CVE-2025-32463Vulnerability
Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability
Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on .
Reported by 1 independent source · first reported by Group-IB · last reported
Last reported 7 months ago
CISA KEVAdded 29 Sep 2025
Fix due 20 Oct 2025
Used by ransomware: not knownCISA KEV catalogue
Fix due 20 Oct 2025
Used by ransomware: not knownCISA KEV catalogue
EPSS55.5%
higher than 99% of CVEsFIRST EPSS, as of 23 Oct 2026
higher than 99% of CVEsFIRST EPSS, as of 23 Oct 2026
What the reports say
1 report, newest first · the exact sentence from each-
How Hastalamuerte Operates: Group-IB’s Analysis of The Gentlemen’s Attack Methods“CVE-2025-32463: affecting Sudo before 1.9.17p1, allowing local users to obtain root access.”
Indicators reported together
named in the same reports- 51b9f246d6da8563…e6a3a7baebd2in 1 report
- 3ab9575225e00a83…5fbe5c5c9235in 1 report
- password-whamola[.]netin 1 report
- 2834114ff7e487c4…6ff35309307bin 1 report
- 194.87.31[.]69in 1 report
- d65c293efb5e6d033c83b2ac472bf0cbin 1 report
Copy these 6 indicators · defanged
Also named with it: CVE-2024-55591, CVE-2024-37085, CVE-2023-27532
Thanks — we review every report.