diff --git a/packages/system/changelog.yml b/packages/system/changelog.yml
index 16e9e19b77d..b30609cc44a 100644
--- a/packages/system/changelog.yml
+++ b/packages/system/changelog.yml
@@ -1,4 +1,9 @@
 # later versions go on top
+- version: "2.22.3"
+  changes:
+    - description: Fix parsing of sudo auth messages that omit the TTY field while preserving existing TTY and sudo error parsing.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/20587
 - version: "2.22.2"
   changes:
     - description: Replace the hardcoded host link in the "[Metrics System] Overview" dashboard with a dashboard-to-dashboard drilldown, so navigation to "[Metrics System] Host Overview" works across Kibana Spaces (including after "Copy to Space").
diff --git a/packages/system/data_stream/auth/_dev/test/pipeline/test-sudo-no-tty.log b/packages/system/data_stream/auth/_dev/test/pipeline/test-sudo-no-tty.log
new file mode 100644
index 00000000000..4cc75b359e1
--- /dev/null
+++ b/packages/system/data_stream/auth/_dev/test/pipeline/test-sudo-no-tty.log
@@ -0,0 +1 @@
+Aug  6 19:42:10 server01 sudo[18432]: alice : PWD=/home/alice ; USER=root ; COMMAND=/usr/bin/id
diff --git a/packages/system/data_stream/auth/_dev/test/pipeline/test-sudo-no-tty.log-config.yml b/packages/system/data_stream/auth/_dev/test/pipeline/test-sudo-no-tty.log-config.yml
new file mode 100644
index 00000000000..4d8e1a59f14
--- /dev/null
+++ b/packages/system/data_stream/auth/_dev/test/pipeline/test-sudo-no-tty.log-config.yml
@@ -0,0 +1,7 @@
+fields:
+  event:
+    timezone: "+0000"
+  input.type: log
+dynamic_fields:
+  "event.ingested": "^.*$"
+  "@timestamp": "^[0-9]{4}(-[0-9]{2}){2}T[0-9]{2}(:[0-9]{2}){2}\\.[0-9]{3}Z$"
diff --git a/packages/system/data_stream/auth/_dev/test/pipeline/test-sudo-no-tty.log-expected.json b/packages/system/data_stream/auth/_dev/test/pipeline/test-sudo-no-tty.log-expected.json
new file mode 100644
index 00000000000..91652ad3cf3
--- /dev/null
+++ b/packages/system/data_stream/auth/_dev/test/pipeline/test-sudo-no-tty.log-expected.json
@@ -0,0 +1,56 @@
+{
+    "expected": [
+        {
+            "@timestamp": "2026-08-06T19:42:10.000Z",
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "category": [
+                    "process"
+                ],
+                "kind": "event",
+                "original": "Aug  6 19:42:10 server01 sudo[18432]: alice : PWD=/home/alice ; USER=root ; COMMAND=/usr/bin/id",
+                "timezone": "+0000",
+                "type": [
+                    "start"
+                ]
+            },
+            "host": {
+                "hostname": "server01"
+            },
+            "input": {
+                "type": "log"
+            },
+            "message": "alice : PWD=/home/alice ; USER=root ; COMMAND=/usr/bin/id",
+            "process": {
+                "name": "sudo",
+                "pid": 18432
+            },
+            "related": {
+                "hosts": [
+                    "server01"
+                ],
+                "user": [
+                    "alice",
+                    "root"
+                ]
+            },
+            "system": {
+                "auth": {
+                    "sudo": {
+                        "command": "/usr/bin/id",
+                        "pwd": "/home/alice",
+                        "user": "root"
+                    }
+                }
+            },
+            "user": {
+                "effective": {
+                    "name": "root"
+                },
+                "name": "alice"
+            }
+        }
+    ]
+}
diff --git a/packages/system/data_stream/auth/elasticsearch/ingest_pipeline/message.yml b/packages/system/data_stream/auth/elasticsearch/ingest_pipeline/message.yml
index 29899cfcfb3..0342f06f678 100644
--- a/packages/system/data_stream/auth/elasticsearch/ingest_pipeline/message.yml
+++ b/packages/system/data_stream/auth/elasticsearch/ingest_pipeline/message.yml
@@ -18,7 +18,7 @@ processors:
         - '^%{DATA:system.auth.ssh.event} %{DATA:system.auth.ssh.method} for (invalid user)?%{DATA:user.name} from %{IPORHOST:source.address} port %{NUMBER:source.port:long} ssh2(: %{GREEDYDATA:system.auth.ssh.signature})?'
         - '^%{DATA:system.auth.ssh.event} user %{DATA:user.name} from %{IPORHOST:source.address}'
         - '^Did not receive identification string from %{IPORHOST:system.auth.ssh.dropped_ip}'
-        - '^%{DATA:user.name} :( %{DATA:system.auth.sudo.error} ;)? TTY=%{DATA:system.auth.sudo.tty} ; PWD=%{DATA:system.auth.sudo.pwd} ; USER=%{DATA:system.auth.sudo.user} ; COMMAND=%{GREEDYDATA:system.auth.sudo.command}'
+        - '^%{DATA:user.name} :(?: ((?!TTY=)%{DATA:system.auth.sudo.error}) ;)?(?: TTY=%{DATA:system.auth.sudo.tty} ;)? PWD=%{DATA:system.auth.sudo.pwd} ; USER=%{DATA:system.auth.sudo.user} ; COMMAND=%{GREEDYDATA:system.auth.sudo.command}'
         - '^new group: name=%{DATA:group.name}, GID=%{NUMBER:group.id}'
         - '^new user: name=%{DATA:user.target.name}, UID=%{NUMBER:user.target.id}, GID=%{NUMBER:group.id}, home=%{DATA:system.auth.useradd.home}, shell=%{DATA:system.auth.useradd.shell}$'
   - set:
diff --git a/packages/system/manifest.yml b/packages/system/manifest.yml
index 7cd16f18eef..9a4fe2e6a21 100644
--- a/packages/system/manifest.yml
+++ b/packages/system/manifest.yml
@@ -1,7 +1,7 @@
 format_version: 3.4.0
 name: system
 title: System
-version: "2.22.2"
+version: "2.22.3"
 description: Collect system logs and metrics from your servers with Elastic Agent.
 type: integration
 categories: