Is CVE-2026-96512 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-96512 being exploited in the wild.

How severe is CVE-2026-96512?

High severity, with a CVSS score of 7.8, published 23 September 2026.

Which products and versions are affected?

Sudo versions with NOTBEFORE/NOTAFTER support and missing 'Z' timezone handling.

Is there a fix for CVE-2026-96512?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-96512 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-96512?

Check whether you run Sudo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96512: sudo time-based access restriction bypass via TZ environment variable

CVE-2026-96512 · Severity: high · CVSS 7.8 · Published 2026-09-23

sudo, a critical privilege escalation tool used on almost all Unix systems, has a flaw in how it validates time-based access restrictions (NOTBEFORE and NOTAFTER rules). An unprivileged local user can manipulate the TZ environment variable to shift the authorization time window by up to 25 hours, allowing them to execute commands that should be blocked by time-based policies. While user authentication is not bypassed, this could allow unauthorized access to time-restricted commands such as maintenance operations or administrative tasks.

Quick answers

Is CVE-2026-96512 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-96512 being exploited in the wild.
How severe is CVE-2026-96512?: High severity, with a CVSS score of 7.8, published 23 September 2026.
Which products and versions are affected?: Sudo versions with NOTBEFORE/NOTAFTER support and missing 'Z' timezone handling.
Is there a fix for CVE-2026-96512?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-96512 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-96512?: Check whether you run Sudo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in sudo's evaluation of NOTBEFORE and NOTAFTER timestamps when the 'Z' timezone indicator is omitted; sudo relies on the calling user's TZ environment variable to interpret the timestamp. A local unprivileged user can set TZ to an extreme offset to manipulate time evaluation in a setuid-root context, bypassing the intended time-based authorization check. The attack requires local access and does not affect authentication mechanisms, only the temporal scope of sudoers rules.

Affected products

sudo versions with NOTBEFORE/NOTAFTER support and missing 'Z' timezone handling

Timeline

2026-09-23: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.