DIQQAT! It can allow you to avoid weak and time-limited checks and carry out higher-level orders!

Reporting by Uzbekistan UZCERT IncidentsRead the original at uzcert.uz

Executive Summary

A security vulnerability, CVE-2026-96512, exists in Sudo versions 1.8.20 through 1.9.17p2 that allows bypassing time-based permission restrictions. The vulnerability stems from how Sudo handles the TZ environment variable during time calculations, specifically when using NOTBEFORE and NOTAFTER parameters in sudoers rules. Because Sudo inherits environment variables, a local user can manipulate the TZ setting to shift time calculations by up to 25 hours forward or backward. This manipulation can cause time-based restrictions set by administrators to be incorrectly evaluated, potentially allowing execution of commands outside the intended time window. The vulnerability does not bypass Sudo's password checks or PAM authentication; exploitation requires an existing local user account and existing Sudo permissions.

Facts Only

* The vulnerability is CVE-2026-96512.
* It affects Sudo versions from 1.8.20 to 1.9.17p2.
* The issue relates to Sudo's handling of the TZ environment variable during time calculations.
* Permissions are restricted using NOTBEFORE and NOTAFTER parameters in sudoers rules.
* Time zone indicators affect the calculation by up to 25 hours forward or backward.
* Sudo is a setuid-root program that can inherit user environment variables, including TZ.
* The vulnerability does not bypass Sudo password checking or PAM authentication.
* Exploitation requires a local user account and existing sudo permissions.
* Red Hat assessed the vulnerability with a CVSS score of 7.8.
* The fix was introduced in the Sudo main development branch on August 29, 2026.

Full Take

The core dynamic observed here is the fragility introduced when time-based authorization relies on external environmental context, specifically the system's time zone setting. The mechanism relies on an implicit trust that the environment variables passed to a privileged process (Sudo) accurately reflect the intended temporal boundaries. When this trust is broken by manipulating the TZ variable, the control shifts from administrative intent to computational artifact. The fact that this vulnerability does not touch authentication mechanisms like passwords or PAM suggests the failure is in authorization logic, not identity verification—an important distinction for resilience planning. The primary implication is that temporal controls designed for operational necessity can be subverted through environmental manipulation rather than credential compromise. Organizations must move beyond patching application code to scrutinizing the entire execution environment and explicitly defining temporal boundaries using unambiguous standards like UTC to mitigate this class of control bypass. What are the unspoken assumptions organizations make about the integrity of the runtime environment when applying time-gated policies? How robust is the assumption that system environment variables passed to privileged processes remain immutable in practice?

From the original · Uzbekistan UZCERT Incidents

ATTENTION! It can allow bypassing time-based permission restrictions and executing higher-privileged commands!

Read the full story at uzcert.uz

Sentinel — Human

Confidence

The text reads like detailed technical security advisement, mixing factual data with prescriptive steps, suggesting human authorship informed by deep technical expertise rather than pure synthetic generation.

Signals Detected

Moderate sentence length variance; functional and dense structure typical of technical reporting.

High coherence; clearly structured progression from problem identification to mechanism explanation to remediation steps.

Direct, fact-based structure; avoids vague attribution while citing specific CVEs and version numbers.

Content relies on specific technical details (CVEs, package versions, methodology references) that suggest deep domain knowledge, but the framing is instructional rather than purely objective reporting.

Human Indicators

Use of specific, cutting-edge security nomenclature (CVEs, CVSS scores, PAM, TZ environment variables) within a prescriptive context suggests expert knowledge or detailed research.

The inclusion of nuanced advice on *how* to detect exploitation versus the immediate threat is characteristic of human security writing aiming at practitioners.