CVE-2026-77654

Deferred Deferred - Pending Action

Privilege Escalation in Horizon Security Analyzer

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: AlgoSec

Description

Improper Privilege Management vulnerability in Horizon Security Analyzer (formerly AlgoSec Firewall Analyzer) on Linux, 64 bit allows Privilege Escalation and Parameter Injection. A local user with access to the command line may escalate their privileges by abusing the parameters of a command that is approved in the sudoers file. This issue affects Horizon Security Analyzer : A33.10, A33.20 and A33.30.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-08

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-77654

Affected Vendors & Products

Vendor	Product	Version / Range
algosec	horizon_security_analyzer	A33.10
algosec	horizon_security_analyzer	A33.20
algosec	horizon_security_analyzer	A33.30

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-266	A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This is an Improper Privilege Management vulnerability in Horizon Security Analyzer on Linux. A local user with command line access can escalate privileges by manipulating parameters of a sudoers-approved command, potentially leading to unauthorized system access or control.

Impact Analysis

An attacker with local access could gain elevated privileges, allowing them to execute arbitrary commands, access sensitive data, or disrupt system operations. This could lead to data breaches, system compromise, or unauthorized modifications.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Review and restrict sudoers file permissions for Horizon Security Analyzer commands. Ensure only necessary parameters are allowed and update to the latest patched version (A33.30 or later).

Hi! I’m here to help you understand CVE-2026-77654. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70