CVE-2026-57223

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the Windows service installation and parameter-update logic in src/win32-service.c can pass an unquoted service ImagePath to CreateServiceA. When Suricata is installed below a path containing spaces and an earlier path component is writable by a local low-privileged attacker, Windows can execute an attacker-controlled program as LocalSystem, resulting in local privilege escalation. This issue is fixed in versions 8.0.6 and 7.0.17.

• CWE-428

• https://github.com/OISF/suricata/commit/0dad38fff024b4fec9bc8144d8b94dbca39aac2e
• https://github.com/OISF/suricata/commit/2b924d47cc51d0b7760cda3519f2c04a2f65ea38
• https://github.com/OISF/suricata/commit/ac1b3cc1ef3af65ce92da28261d445167eb8234d
• https://github.com/OISF/suricata/pull/15676
• https://github.com/OISF/suricata/releases/tag/suricata-7.0.17
• https://github.com/OISF/suricata/releases/tag/suricata-8.0.6
• https://github.com/OISF/suricata/security/advisories/GHSA-jh8w-wf3f-58jp
• https://redmine.openinfosecfoundation.org/issues/8600

Published

Sep 18, 2026

Last Modified

Sep 23, 2026

Status

Undergoing Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-57218RabbitMQ is a messaging and streaming broker. Prior to 4.2.6…6.5
• CVE-2026-57219RabbitMQ is a messaging and streaming broker. Prior to 3.13.…7.5
• CVE-2026-5722The MoreConvert Pro plugin for WordPress is vulnerable to Au…9.8
• CVE-2026-57220RabbitMQ is a messaging and streaming broker. Prior to 4.2.6…7.5
• CVE-2026-57221RabbitMQ is a messaging and streaming broker. Prior to 3.13.…5
• CVE-2026-57222Suricata is a network Intrusion Detection System, Intrusion …5.3
• CVE-2026-57224Suricata is a network Intrusion Detection System, Intrusion …6.5
• CVE-2026-57225Suricata is a network Intrusion Detection System, Intrusion …3.3
• CVE-2026-57226Suricata is a network Intrusion Detection System, Intrusion …3.7
• CVE-2026-57227Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2026-57228Suricata is a network Intrusion Detection System, Intrusion …8.2
• CVE-2026-57229Suricata is a network Intrusion Detection System, Intrusion …5.3