sudo (Product): news timeline & CVEs

Sudo Security Vulnerability Lets Attackers Escalate Privileges

A Sudo flaw, CVE-2026-96512, lets local users bypass time-based sudoers rules via a crafted TZ variable.

A high-severity flaw tracked as CVE-2026-96512 affects Sudo 1.8.20 through 1.9.17p2. parse_gentime() uses mktime() and the user-controlled TZ variable, so a local user can shift NOTBEFORE or NOTAFTER checks by about 25 hours with a value such as TZ=XXX24. The bug does not bypass passwords or PAM and requires an existing time-based sudoers rule. Researcher Ermenson Junior reported it on August 28, 2026; Todd Miller committed a fix the next day, but it was not yet in a Sudo 1.9.18 release.

Cyber Security NewsSep 25, 09:29 UTC · 2d agoVulnerability 3 sources CVE-2026-96512

Sudo Vulnerability Lets Attackers Bypass Time-Based Authorization Controls

CVE-2026-96512 lets local users skew Sudo time-based authorization windows via the TZ variable.

A high-severity Sudo flaw, CVE-2026-96512, lets a local user influence NOTBEFORE and NOTAFTER sudoers checks through the TZ environment variable. Versions 1.8.20 through 1.9.17p2 are affected; parse_gentime() uses mktime(), which honors TZ, and an extreme offset such as TZ=XXX24 can shift the window by about 25 hours. The bug does not bypass PAM and requires an existing time-restricted rule. Upstream commit 1820a349687522f51023d1ae5925125f59679a8c removes TZ before timezone setup, but that fix was not yet in a released Sudo version; Red Hat tracks Bug 2539327.

GBHackersupdated Sep 25, 09:29 UTC · 2d agofirst Sep 25, 07:26 UTC · 2d agoVulnerability 3 sources CVE-2026-96512

CVE-2026-96512: sudo: TZ still affects NOTBEFORE/NOTAFTER

Sudo CVE-2026-96512 lets a local user shift sudoers time windows by abusing TZ.

CVE-2026-96512 was assigned to a sudo bug in which the calling user's TZ variable still affects NOTBEFORE and NOTAFTER checks in sudoers. If the rule timestamp has no trailing Z, parse_gentime() uses mktime(), which reads TZ; an earlier commit fixed only localtime_r(). A local user can set an extreme offset and move the time window by almost 25 hours. The report does not describe remote or in-the-wild exploitation.

oss-securityupdated Sep 25, 09:29 UTC · 2d agofirst Sep 24, 16:28 UTC · 2d agoVulnerability 3 sources CVE-2026-96512

USN-8803-1: Sudo vulnerability

Ubuntu warned Sudo can skip intercept checks, letting local users bypass policy and logging.

Ubuntu Security Notice USN-8803-1 describes a Sudo vulnerability found by Guannan Wang, Zhanpeng Liu, and Guancheng Li. Sudo failed to apply intercept policy checks when commands were executed under certain circumstances. A local attacker already permitted to run specific commands could bypass policy enforcement and logging and execute unauthorized programs. The notice does not name a CVE or report exploitation in the wild.

Ubuntu Security NoticesSep 22, 14:15 UTC · 4d agoAdvisory

sudo and OpenDoas timestamp files (2020)

A 2020 write-up demonstrates reusing sudo timestamp files across SSH sessions for passwordless sudo, fixed via session-leader start times.

The author contrasts OpenBSD doas(1)'s persist feature, which uses TIOCSETVERAUTH/TIOCCHKVERAUTH/TIOCCLRVERAUTH ioctls to track authenticated TTYs with timeouts, with sudo(8)'s timestamp files bound to PPID or TTY number. A proof-of-concept reused a sudo timestamp file after an SSH session ended by opening a newly recycled pseudo-tty and calling clone(2) in a loop until matching the sshd subprocess's PPID, then ran sudo without a password. The proposed mitigation binds timestamps to the session leader's monotonic start time; this was implemented in OpenDoas and proposed upstream. sudo(8) 1.8.22 (2017) already added the equivalent session start-time check (commit 1709dc7f77).

Lobsters · securitySep 18, 19:36 UTC · 8d agoResearch

August 2026 CVE Landscape

Insikt Group catalogs 73 high-impact August 2026 CVEs (43 Very Critical), including PaperCut, Zimbra, and Metabase flaws actively exploited or weaponized.

Recorded Future's Insikt Group identified 73 high-impact vulnerabilities in August 2026, 43 rated Very Critical, spanning 45 vendors with Microsoft accounting for roughly 11%. 31 vulnerabilities surfaced via CISA's KEV catalog, with others validated via open sources, vendor telemetry, and honeypot data. New Nuclei detection templates were released for CVE-2025-62593 (Ray), CVE-2026-72898 (Metabase), and CVE-2026-9198 (IBM Langflow). The report also highlights two AI-assisted operations: UAT-10147 exploited Zimbra, AjaxPro, Nacos, and Telerik servers before using DeepAudit and PentestGPT post-compromise, while a separate Chinese-speaking actor weaponized Hermes Agent and DeepSeek in a failed attempt.

Recorded FutureSep 8, 00:00 UTC · 19d agoVulnerability in the wildCVE-2025-62593 CVE-2026-72898 CVE-2026-9198+4 CVEs1

sudo

Timeline6 articles

Related CVEsby mentions

Appears with