CVE-2026-59676

FAUCET Score

A Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in seunshare of selinux policycoreutils allows a user calling seunshare that is running in the unconfined SELinux domain to delete arbitrary root-owned files, This issue affects policycoreutils through 3.10.

First published: Jul 23, 2026Last modified: Jul 23, 2026

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 0, <= 3.10CPE match	cpe:2.3:a:selinux_project:selinux::::::::

CVSS Data

CVSS version used by this source: 4.0

5.8MEDIUM

CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

LOCAL

Attack Complexity

HIGH

Attack Requirements

NONE

Privileges Required

LOW

User Interaction

NONE

VS Confidentiality

NONE

VS Integrity

LOW

VS Availability

HIGH

SS Confidentiality

NONE

SS Integrity

NONE

SS Availability

NONE

Exploit Maturity

NOT_DEFINED

CvssVersion

4.0

Exploit Intelligence

EPSS Score

0.09%

Probability of exploitation in next 30 days

EPSS Percentile

0.4%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.0009 is in the 6th percentile among its peer group of 1,297 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.4 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Vendor Advisories (1)

microsoft2026-Jul/CVE-2026-59676Moderate

Local File Deletion Attack Vector in rm_rf() in seunshare

Jul 14, 2026

References

bugzilla.suse.com / show_bug.cgi

security.opensuse.org / 2026/07/15/selinux-seunshare.html