Vuln: CVE-2019-14287 | Detection.FYI

Potential Sudo Privilege Escalation via CVE-2019-14287

Sep 19, 2026 · Domain: Endpoint OS: Linux Use Case: Threat Detection Tactic: Privilege Escalation Data Source: Elastic Defend Use Case: Vulnerability Data Source: Elastic Endgame Data Source: Auditd Manager Data Source: Crowdstrike Data Source: SentinelOne Resources: Investigation Guide Noise: High Performance: Normal Profile: Aggressive Threat: Vulnerability Exploit Rule Type: Event Correlation (EQL) Platform: Linux Vuln: CVE-2019-14287 ·
Share on:

This rule monitors for the execution of a suspicious sudo command that is leveraged in CVE-2019-14287 to escalate privileges to root. Sudo does not verify the presence of the designated user ID and proceeds to execute using a user ID that can be chosen arbitrarily. By using the sudo privileges, the command "sudo -u#-1" translates to an ID of 0, representing the root user. This exploit may work for sudo versions prior to v1.28.

Read More