DirtyClone CVE-2026-43503: Unprivileged Process Spawning Root Shell via /usr/bin/su

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•6

Detects a potential privilege escalation attempt targeting the DirtyClone (CVE-2026-43503) vulnerability, where an unprivileged process executes /usr/bin/su with specific command line arguments to spawn a shell without proper authentication, effectively gaining root access.