CVE-2026-96512 Red Hat CVE debrief

Who should care

System administrators and security teams responsible for managing systems that use sudo with time-based access restrictions should assess their exposure and update their configurations accordingly.

Why it matters

CVE-2026-96512 allows an unprivileged local user to manipulate time-based authorization checks in sudo, potentially leading to unauthorized command execution. System administrators and security teams should assess their exposure and update their configurations to prevent exploitation.

• Potential for unauthorized command execution outside intended time windows
• Need for verification of sudoers rule configurations
• Possible impact on system security posture due to manipulation of time-based authorization checks

Technical summary

The flaw in sudo occurs when sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator. This causes the time evaluation to rely on the TZ environment variable inherited from the calling user. An unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid.

Defensive priority

High priority for systems using sudo with time-based access restrictions

Recommended defensive actions

• Review and update sudoers rules to ensure proper use of time-based access restrictions
• Verify that sudo is configured to use a secure timezone setting
• Monitor system logs for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the flaw in sudo. Red Hat has released errata and a security advisory for this issue. The flaw occurs when sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator. This causes the time evaluation to rely on the TZ environment variable inherited from the calling user. An unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing The

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.