EIP-2026-102837

This exploit leverages a writable Snort configuration file by the 'contents' group to load a malicious shared library via the 'dynamicengine' directive, achieving root privilege escalation on a FireEye appliance. The shared library executes arbitrary commands upon Snort process restart.