Sudo Security Vulnerability Lets Attackers Escalate Privileges
A Sudo flaw, CVE-2026-96512, lets local users bypass time-based sudoers rules via a crafted TZ variable.
A high-severity flaw tracked as CVE-2026-96512 affects Sudo 1.8.20 through 1.9.17p2. parse_gentime() uses mktime() and the user-controlled TZ variable, so a local user can shift NOTBEFORE or NOTAFTER checks by about 25 hours with a value such as TZ=XXX24. The bug does not bypass passwords or PAM and requires an existing time-based sudoers rule. Researcher Ermenson Junior reported it on August 28, 2026; Todd Miller committed a fix the next day, but it was not yet in a Sudo 1.9.18 release.
- CVE-2026-96512 affects Sudo 1.8.20 through 1.9.17p2.
- Crafted TZ values can shift NOTBEFORE and NOTAFTER checks by about 25 hours.
- Attackers need an existing time-restricted sudoers rule; passwords and PAM still apply.
- Todd Miller patched main on August 29, 2026; 1.9.18 was not yet released.
- CVEs
- CVE-2026-96512
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-96512 | Time-window bypass via TZ manipulation in sudo NOTBEFORE/NOTAFTER rules | 7.8 | <1% | PoC ×2 |
From the original article
2 min read at cybersecuritynews.com
A high-severity security vulnerability in Sudo could allow local attackers to bypass time-based access restrictions and run commands with elevated privileges. Tracked as CVE-2026-96512, the flaw affects Sudo versions from 1. 8.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.