ATTENTION! It can allow bypassing time-based permission restrictions and executing higher-privileged commands!
A serious security vulnerability has been discovered in Sudo, which is widely used for managing administrative privileges on Linux systems. This issue, reported as CVE-2026-96512, can allow attackers to bypass time-based restrictions set by administrators and execute permitted commands outside of the specified time.
The vulnerability affects versions of Sudo from 1.8.20 to 1.9.17p2. The issue is related to how Sudo handles the TZ environment variable. Red Hat has assessed this vulnerability as a high-priority issue, assigning a CVSS score of 7.8.
Why is Sudo important?
Sudo is a tool in Linux and Unix-like operating systems that allows users to execute certain commands as another user, typically root.
For example, instead of granting all users full administrator privileges, it can allow them to execute only the necessary commands.
These permissions are usually set via the sudoers configuration.
Furthermore, Sudo can restrict permissions within a specific time range in certain situations. For instance, a staff member might be allowed to execute a specific administrative command on the server only during a specified date or time range.
This mechanism is at the heart of the CVE-2026-96512 vulnerability.
How does the vulnerability work?
The problem is related to Sudo's time handling mechanism.
The validity period of a permission is set by the NOTBEFORE and NOTAFTER parameters in the sudoers rules.
These can be understood simply as follows:
NOTBEFORE — specifies when the permission starts to be valid; NOTAFTER — specifies when the permission ends.
For example, a user might be allowed to execute an important command only within a specific time range.
The problem is that when some time indicators in Sudo are not explicitly specified, it uses the system's TZ environment variable for calculation. According to Red Hat information, the parse_gentime() function reinterprets these time values using mktime(), and the value of the TZ variable can affect the calculation.
Since Sudo is a setuid-root program, it can inherit certain environment variables from the user's environment during startup.
As a result, the local user might set a specific TZ value, affecting how Sudo interprets time.
In simple terms, what is the danger?
Imagine that a user is only allowed to execute an important administrative command between 09:00 and 18:00. This permission should not automatically apply after 18:00.
However, an attacker can exploit the flaw in Sudo's time zone handling to make the system appear as if the current time is a different time. According to Red Hat information, the specific POSIX time zone value can shift the time calculation by up to 25 hours forward or backward. As a result, a NOTAFTER restriction that has already expired might still be considered valid, or a NOTBEFORE restriction that has not yet started might be considered active.
This allows an attacker to attempt to use the permission outside of the time specified to them.
Does this vulnerability bypass the Sudo password?
No. This is very important.
CVE-2026-96512 does not bypass Sudo's password checking or the PAM (Pluggable Authentication Modules) mechanism.
For an attacker to exploit this:
- Must have a local user account on the system;
- Must have permission to execute the command allowed by Sudo;
- Must use time-based restrictions like NOTBEFORE or NOTAFTER.
This vulnerability does not convert a regular user into a root user without any permission. It weakens the time-based control of existing Sudo permissions.
Red Hat also emphasizes that this does not undermine the authentication itself, but rather the time-based authorization decision.
Which Sudo versions are at risk?
The vulnerability affects releases from Sudo 1.8.20 to 1.9.17p2.
The time-based authorization capability was introduced in Sudo 1.8.20.
| Sudo Version | Status |
|---|---|
| 1.8.20 and later vulnerable releases | ⚠️ Affected |
| 1.9.17p2 | ⚠️ Affected |
| Fixed delivery packages | ✅ Protected by updates |
In this context, it is important to note that Sudo is distributed as a separate package in Linux distributions. Therefore, instead of relying solely on the upstream version number of Sudo, security updates from the distribution being used should also be checked.
For example, Red Hat announced its security information regarding CVE-2026-96512 on September 23, 2026. Corresponding packages are indicated for Red Hat Enterprise Linux 7, 8, 9, and 10, as well as some other Red Hat products.
When was the vulnerability discovered?
Independent security researcher Ermenson Junior reported this issue on August 28, 2026. The fix was introduced by Todd Miller in the Sudo main development branch on August 29, 2026. According to Red Hat information, this fix was not yet included in the Sudo 1.9.18 release at that time.
This means organizations should check security updates released by their Linux distributions, rather than waiting for the upstream release.
What is the main risk for organizations?
CVE-2026-96512 is particularly important for environments where temporary administrative privileges are granted on servers.
For example:
- Allowing a system administrator to execute a specific command only during working hours;
- Granting temporary root privileges to a technical employee;
- Executing specific administrative commands during service delivery windows;
- Restricting the management of important system files via Sudo based on time.
In such situations, this mechanism can be part of the security control. If an organization uses the NOTBEFORE and NOTAFTER conditions exactly as specified, this vulnerability can lead to the execution of permissions outside the specified times.
What should system administrators do?
1. Check the Sudo version
Identify the installed Sudo version on Linux servers and workstations and check its compatibility with the security updates released by the vendor.
Particular attention should be paid to versions in the range of Sudo 1.8.20–1.9.17p2 used on systems.
2. Install distribution updates
Sudo is managed as a separate package in Linux distributions such as Ubuntu, Debian, Red Hat Enterprise Linux, SUSE, and others. Therefore, administrators should:
- Check the system's security updates;
- Install the fixes released by the vendor for Sudo;
- Recheck the Sudo version after the update.
Red Hat announced the relevant security updates for CVE-2026-96512 on September 23–24, 2026.
3. Check sudoers rules
Organization administrators should check whether NOTBEFORE and NOTAFTER conditions are used or not in the sudoers configuration. If these restrictions exist, it is important to check if the time zone is specified in the time values. Sudo documentation notes that time values can be shown in UTC (Z) or with a specific offset from UTC.
4. Specify the time zone clearly
To reduce ambiguity in time-based authorization rules, it is recommended to use UTC or a precise time zone offset as much as possible. This does not completely eliminate the vulnerability, but it can reduce ambiguities related to local time zones in time calculations.
5. Pay attention to the TZ environment variable
Administrators must monitor environment variables that can be modified by users before Sudo starts. If suspicious activities related to unexpected TZ values are detected, relevant authentication, Sudo, and system logs should be analyzed.
How can exploitation be detected?
CVE-2026-96512 is not an exploit that can be exploited remotely. Therefore, organizations should first examine the activities of local users and the commands executed via Sudo.
Attention should be paid to the following situations:
- Sudo commands executed outside the allowed time range;
- Administrative commands that do not align with a user's usual activities;
- Suspicious or unexpected TZ values; - Unusual processes executed with root privileges via Sudo;
- Sudden changes in the time of administrative privileges usage;
- Unknown or recently created local user accounts.
However, these signs do not automatically prove that CVE-2026-96512 has been exploited. They should be evaluated as a signal for further investigation.
Do not mix CVE-2026-96512 and other Sudo vulnerabilities
Several other security issues related to Sudo have also been announced during 2026. For example, CVE-2026-82474 is another vulnerability related to bypassing policy restrictions via execveat/fexecve in Sudo, for which Red Hat released updates for RHEL 9 and RHEL 10. Therefore, administrators should regularly check other security updates related to the Sudo package installed on their systems, not just CVE-2026-96512. The issue with CVE-2026-96512 is about the time-based authorization mechanism in Sudo, which can allow manipulation of NOTBEFORE and NOTAFTER restrictions by manipulating the TZ environment variable, allowing for incorrect interpretation of the restrictions. Red Hat assessed this vulnerability with a CVSS score of 7.8, "Important".
To exploit the vulnerability, the attacker must first have a local user account and the corresponding Sudo permission. Furthermore, they cannot bypass the Sudo password or PAM authentication. The issue is mainly related to the disruption of time-based permission control.
Therefore, it is recommended that system administrators check the Sudo version, install security updates released by the vendor, review the NOTBEFORE and NOTAFTER parameters in sudoers rules, and use authorization rules with explicitly specified time zones.