CVE-2026-57223

Executive Summary

CVE-2026-57223 is a local privilege escalation vulnerability in the Windows service installation and parameter-update logic of Suricata, an open-source network IDS/IPS and NSM engine. The flaw (CWE-428, unquoted search path) affects Windows installations of Suricata prior to 7.0.17 and 8.0.6 where the installation path contains spaces and an earlier path component is writable by a low-privileged local user. Successful exploitation allows an attacker-controlled executable to be launched as LocalSystem, yielding full administrative control of the host. The issue is rated CVSS 7.0 (High) with a local attack vector, and no public PoC or KEV listing exists.

Technical Analysis

The vulnerability resides in src/win32-service.c, the Windows service management source file responsible for installing and updating the Suricata service. According to the NVD description, prior to versions 7.0.17 and 8.0.6, this logic can pass an unquoted service ImagePath to the Win32 API CreateServiceA.

Windows service definitions store the executable path in a registry value (ImagePath). When that path is passed to the Service Control Manager (SCM) without surrounding quotation marks, the SCM does not treat the path as a single literal token. Instead, it resolves the executable using a defined search order: for an unquoted path such as:

C:\Program Files\Suricata\suricata.exe

Windows attempts to execute, in order:

1. C:\Program.exe
2. C:\Program Files\Suricata\suricata.exe

If any intermediate directory named by a path component is writable by a low-privileged user, that user can plant a malicious executable at the truncated path (for example, suricata.exe directly under C:\Program Files\Suricata\ if that directory is writable, or an earlier component if the base path is unusually shallow). When the service starts — typically boot time, or after a service restart — the SCM launches the attacker's binary in the security context of the service account, which for Suricata's Windows service is LocalSystem. Because the service runs with the highest local privilege, this constitutes a local privilege escalation from a low-privileged user to NT AUTHORITY\SYSTEM.

The attack surface is therefore narrow but precise: it requires (a) a Windows host running an affected Suricata build, (b) an installation path containing spaces, and (c) a preceding path component writable by the attacker. The CVSS vector reflects this — AV:L (local), AC:H (high complexity, given the path and permission preconditions), PR:L (low privileges), UI:N (no user interaction), and full C:H/I:H/A:H impact. The S:U scope reflects that the attacker gains privilege on the same host without crossing a trust boundary beyond the local LocalSystem escalation.

The core defect is a failure to quote the ImagePath string passed to CreateServiceA. The fix in 7.0.17/8.0.6 would necessarily ensure the executable path is enclosed in quotation marks so Windows resolves it as a single literal path with no ambiguous intermediate candidates.

Exploitation Scenarios

No public PoC is available; this attack chain is inferred from the unquoted service path vulnerability class and the NVD description. No specific function names, binaries, or parameters are invented beyond those stated in the authoritative description (src/win32-service.c, CreateServiceA).

1. Reconnaissance / Target Identification. An attacker with low-privileged local access to a Windows host enumerates services and their ImagePath registry values (for example via sc qc Suricata or querying HKLM\SYSTEM\CurrentControlSet\Services\Suricata\ImagePath). The attacker identifies an unquoted path containing spaces — for example a path whose first space-delimited component falls in a directory writable by their account.

2. Precondition Validation. The attacker confirms the installation path contains a space and that at least one earlier path component is writable by their privilege level. This is the AC:H constraint: not every Suricata installation will satisfy both conditions.

3. Path Interception / Payload Placement. Within the writable intermediate directory, the attacker places an executable whose name matches the truncated component the SCM will attempt first (the service class trigger). The content of the binary is attacker-controlled and executes with LocalSystem privileges once the SCM resolves and launches it. No implementation-specific function names beyond the documented CreateServiceA behavior are asserted here.

4. Trigger and Post-Exploitation Impact. On service restart or host reboot, the Windows Service Control Manager resolves the unquoted path and launches the attacker-controlled binary as LocalSystem. Given a C:H/I:H/A:H impact, the attacker gains full control of Confidentiality, Integrity, and Availability on the host: SYSTEM-level code execution, the ability to disable or tamper with the Suricata IDS/IPS itself, disable defenses, persist, and pivot to other hosts on the monitored network. Because Suricata typically sits on security-critical monitoring infrastructure, compromising the sensor can blind the entire NSM/IDS capability for the segment.

Impact Assessment

Business impact is high. Suricata is commonly deployed as the IDS/IPS/NSM backbone for enterprise network monitoring. A successful local privilege escalation to LocalSystem on a sensor host allows an attacker to:

• Disable, reconfigure, or rootkit the detection engine, creating a blind spot for downstream security monitoring.
• Access captured packet data, logs, and rule sets that may contain sensitive network metadata.
• Use the compromised host as a stable privileged foothold for lateral movement.

The blast radius is limited to Windows hosts running affected Suricata builds that satisfy the path and permission preconditions. CVSS subscores map directly: C:H / I:H / A:H (full loss across all three pillars), AV:L and PR:L (requires local low-privileged foothold), and AC:H (preconditions raise exploitation complexity). EPSS has not been scored by FIRST.org; no KEV listing exists; no public exploit code is known.

Detection Guidance

Sigma Rule

title: Suspicious Executable Created in Writable Service Path Component (Unquoted Service Path)
id: 8f2b1c4a-9d3e-4b7a-a1c2-5e6f7b8c9d0e
status: experimental
description: Detects file creation of an executable in a directory that is an intermediate component of an unquoted Windows service ImagePath, indicative of CVE-2026-57223 path interception.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-57223
author: valtersit.com
date: 2026/01/01
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith: '.exe'
    TargetFilename|contains: 'Program Files'
  filter_legit:
    Image|endswith:
      - '\msiexec.exe'
      - '\TrustedInstaller.exe'
  condition: selection and not filter_legit
falsepositives:
  - Legitimate software installers writing under Program Files
level: high
tags:
  - attack.privilege_escalation
  - attack.t1574.009
  - cve.2026.57223

YARA Rule

rule CVE_2026_57223_Unquoted_ServicePath_Suricata
{
    meta:
        author = "valtersit.com"
        description = "Detects references to Suricata unquoted service ImagePath and win32-service.c artifacts"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-57223"
        date = "2026-01-01"
    strings:
        $s1 = "win32-service.c" ascii nocase
        $s2 = "CreateServiceA" ascii
        $s3 = "Suricata" ascii nocase
        $s4 = "ImagePath" ascii
    condition:
        uint16(0) == 0x5A4D and any of ($s2, $s4) and $s3
}

Suricata IDS Rule

alert smb any any -> any any (msg:"CVE-2026-57223 Suricata unquoted service path write attempt"; flow:to_server,established; content:"ImagePath"; nocase; content:"Suricata"; nocase; distance:0; classtype:attempted-privileges; sid:202657223; rev:1;)

Elastic Detection

file where process.name != null and
  file.name : "*.exe" and
  file.path : "C:\\\\Program Files\\\\Suricata\\*" and
  event.action : ("creation", "modification")

Splunk SPL Query

index=windows EventCode=11 OR EventCode=13
| search TargetFilename="*.exe" TargetFilename="*\\Suricata\\*" OR RegistryValueName="ImagePath"
| stats count min(_time) as firstTime max(_time) as lastTime by ComputerName, User, TargetFilename, RegistryValueName
| where count > 0

Wazuh OSSEC Rule

<group name="windows,suricata,cve-2026-57223,">
  <rule id="100723" level="12">
    <if_sid>60009</if_sid>
    <field name="win.eventdata.targetFilename">\.exe$</field>
    <field name="win.eventdata.targetFilename">Suricata</field>
    <description>CVE-2026-57223: Potential unquoted service path executable planted for Suricata service hijack</description>
    <mitre>
      <id>T1574.009</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence corroborated by tracked sources at the time of writing). The NVD description states the issue is fixed in 8.0.6 and 7.0.17; treat those as the intended remediation targets but validate with the vendor before relying on them operationally.

1. Immediate mitigations:

   • Audit Windows services for unquoted ImagePath values (sc qc, registry review of HKLM\SYSTEM\CurrentControlSet\Services). Manually quote any Suricata ImagePath that contains spaces.
   • Harden NTFS ACLs on intermediate directories under the Suricata install path so low-privileged users cannot create or modify files there.
   • Restrict local interactive logon rights on Suricata sensor hosts to reduce the available low-privileged attacker population.
   • Monitor for unexpected executable creation in install-path directories.

2. Patch / upgrade steps:

   • Upgrade Suricata Windows builds to 7.0.17 or 8.0.6 (or later) once available from the vendor. Verify ImagePath is properly quoted after reinstall.
   • Re-apply path ACL hardening after upgrade.

3. Long-term hardening:

   • Standardize service installation to quoted paths and least-privilege install directories.
   • Include unquoted service path checks in baseline configuration scanning.
   • Treat IDS/NSM sensor hosts as high-value assets requiring restricted local access.

References

• NVD — CVE-2026-57223: https://nvd.nist.gov/vuln/detail/CVE-2026-57223
• Suricata project (OISF) — vendor advisories: https://suricata.io/
• MITRE ATT&CK T1574.009 — Hijack Execution Flow: Path Interception by Unquoted Path: https://attack.mitre.org/techniques/T1574/009/
• CWE-428 — Unquoted Search Path or Element: https://cwe.mitre.org/data/definitions/428.html
• CISA KEV catalog (no listing for this CVE at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, or in-the-wild exploitation evidence is currently associated with CVE-2026-57223, and it is not listed in CISA KEV.