CVE-2026-96512
Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization
A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid. This allows the user to execute commands outside the intended time window. Authentication is not bypassed; only the time-based authorization check is affected.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization
A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid. This allows the user to execute commands outside the intended time window. Authentication is not bypassed; only the time-based authorization check is affected.
- Record
CVE-2026-96512- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-863
- Updated
- 2026-11-02
EUVDEUVD-2026-85290
A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid. This allows the user to execute commands outside the intended time window. Authentication is not bypassed; only the time-based authorization check is affected.
- Record
EUVD-2026-85290- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-jj2h-hcrf-9gfx
A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access...
A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid. This allows the user to execute commands outside the intended time window. Authentication is not bypassed; only the time-based authorization check is affected.
- Record
GHSA-jj2h-hcrf-9gfx- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-863
- Updated
- 2026-11-02
NVD
A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid. This allows the user to execute commands outside the intended time window. Authentication is not bypassed; only the time-based authorization check is affected.
- Record
CVE-2026-96512- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVALPINE-CVE-2026-96512
A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid. This allows the user to execute commands outside the intended time window. Authentication is not bypassed; only the time-based authorization check is affected.
- Record
ALPINE-CVE-2026-96512- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSVBELL-CVE-2026-96512
- Record
BELL-CVE-2026-96512- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-04
Show 26 moreShow less
OSV
Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization
A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid. This allows the user to execute commands outside the intended time window. Authentication is not bypassed; only the time-based authorization check is affected.
- Record
CVE-2026-96512- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-96512
A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid. This allows the user to execute commands outside the intended time window. Authentication is not bypassed; only the time-based authorization check is affected.
- Record
DEBIAN-CVE-2026-96512- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-4258
sudo security update
Sudo is a program designed to allow a sysadmin to give limited root privileges to users and log root activity. The basic philosophy is to give as few privileges as possible but still allow people to get their work done.
Security Fix(es):
A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid. This allows the user to execute commands outside the intended time window. Authentication is not bypassed; only the time-based authorization check is affected.(CVE-2026-96512)
- Record
OESA-2026-4258- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-4259
sudo security update
Sudo is a program designed to allow a sysadmin to give limited root privileges to users and log root activity. The basic philosophy is to give as few privileges as possible but still allow people to get their work done.
Security Fix(es):
A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid. This allows the user to execute commands outside the intended time window. Authentication is not bypassed; only the time-based authorization check is affected.(CVE-2026-96512)
- Record
OESA-2026-4259- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-4260
sudo security update
Sudo is a program designed to allow a sysadmin to give limited root privileges to users and log root activity. The basic philosophy is to give as few privileges as possible but still allow people to get their work done.
Security Fix(es):
A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid. This allows the user to execute commands outside the intended time window. Authentication is not bypassed; only the time-based authorization check is affected.(CVE-2026-96512)
- Record
OESA-2026-4260- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-4261
sudo security update
Sudo is a program designed to allow a sysadmin to give limited root privileges to users and log root activity. The basic philosophy is to give as few privileges as possible but still allow people to get their work done.
Security Fix(es):
A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid. This allows the user to execute commands outside the intended time window. Authentication is not bypassed; only the time-based authorization check is affected.(CVE-2026-96512)
- Record
OESA-2026-4261- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:71609
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:71609- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:75571
Red Hat Security Advisory: sudo security update
- Record
RHSA-2026:75571- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:75579
Red Hat Security Advisory: sudo security update
- Record
RHSA-2026:75579- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:75580
Red Hat Security Advisory: sudo security update
- Record
RHSA-2026:75580- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2026:75571
Important: sudo security update
The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root.
Security Fix(es):
- sudo: sudo: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization (CVE-2026-96512)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:75571- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2026:75579
Important: sudo security update
The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root.
Security Fix(es):
- sudo: sudo: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization (CVE-2026-96512)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:75579- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2026:75580
Important: sudo security update
The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root.
Security Fix(es):
- sudo: sudo: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization (CVE-2026-96512)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:75580- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-96512
A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid. This allows the user to execute commands outside the intended time window. Authentication is not bypassed; only the time-based authorization check is affected.
- Record
UBUNTU-CVE-2026-96512- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVALSA-2026:75571 No score
Important: sudo security update
The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root.
Security Fix(es):
- sudo: sudo: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization (CVE-2026-96512)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:75571- Updated
- 2026-11-02
OSVALSA-2026:75579 No score
Important: sudo security update
The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root.
Security Fix(es):
- sudo: sudo: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization (CVE-2026-96512)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:75579- Updated
- 2026-11-02
OSVALSA-2026:75580 No score
Important: sudo security update
The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root.
Security Fix(es):
- sudo: sudo: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization (CVE-2026-96512)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:75580- Updated
- 2026-11-02
OSVAZL-104940 No score
CVE-2026-96512 affecting package sudo for versions less than 1.9.17-4
A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid. This allows the user to execute commands outside the intended time window. Authentication is not bypassed; only the time-based authorization check is affected.
- Record
AZL-104940- Updated
- 2026-11-05
OSVCLSA-2026-1791552454 No score
sudo: Fix of CVE-2026-96512
- CVE-2026-96512: remove TZ from sudo's own environment in main() before tzset() so NOTBEFORE/NOTAFTER sudoers checks use the system time zone
- Record
CLSA-2026-1791552454- Updated
- 2026-11-02
OSVCLSA-2026-1791564552 No score
sudo: Fix of CVE-2026-96512
- CVE-2026-96512: remove TZ from sudo's own environment in main() before tzset() so NOTBEFORE/NOTAFTER sudoers checks use the system time zone
- Record
CLSA-2026-1791564552- Updated
- 2026-11-02
OSVCLSA-2026-1791570106 No score
Fix CVE(s): CVE-2026-96512
- SECURITY UPDATE: time-based sudoers restrictions bypass via user-controlled TZ
- debian/patches/CVE-2026-96512.patch: remove the user-specified TZ from sudo's environment so NOTBEFORE/NOTAFTER use the system time zone
- CVE-2026-96512
- Record
CLSA-2026-1791570106- Updated
- 2026-11-02
OSVCLSA-2026-1791794851 No score
sudo: Fix of CVE-2026-96512
- CVE-2026-96512: remove TZ from sudo's own environment in main() before tzset() so NOTBEFORE/NOTAFTER sudoers checks use the system time zone
- Record
CLSA-2026-1791794851- Updated
- 2026-11-02
OSVCLSA-2026-1791834762 No score
sudo: Fix of CVE-2026-96512
- CVE-2026-96512: user-specified TZ environment variable allows bypass of sudoers NOTBEFORE and NOTAFTER time restrictions
- Record
CLSA-2026-1791834762- Updated
- 2026-11-02
OSVCLSA-2026-1792204181 No score
sudo: Fix of CVE-2026-96512
- CVE-2026-96512: unset TZ in sudo's own environment before tzset() in main(), working on a private copy of environ made in os_init_common() so the envp passed to the plugins is left unchanged
- Record
CLSA-2026-1792204181- Updated
- 2026-11-02
OSVMGASA-2026-0531 No score
Updated sudo package fixes security vulnerabilities
Sudo through 1.9.17p2 Intercept Policy Bypass via execveat. (CVE-2026-82474) tz environment variable allows bypass of notbefore/notafter time-based authorization. (CVE-2026-96512)
- Record
MGASA-2026-0531- Updated
- 2026-11-02
OSVUSN-8895-1 No score
sudo vulnerability
It was discovered that Sudo did not properly handle time-based access restrictions when sudoers rules used NOTBEFORE or NOTAFTER with timestamps omitting the trailing timezone indicator. A local attacker could possibly use this issue to execute commands outside the intended time window by manipulating the TZ environment variable.
- Record
USN-8895-1- Updated
- 2026-11-02
Affected products
- red hat enterprise linux 10
- red hat enterprise linux 10.0 extended update support
- red hat enterprise linux 7 extended lifecycle support
- red hat enterprise linux 8
- red hat enterprise linux 8.4 advanced mission critical update support
- red hat enterprise linux 8.4 extended update support long-life add-on
- red hat enterprise linux 8.6 advanced mission critical update support
- red hat enterprise linux 8.6 extended update support long-life add-on
- red hat enterprise linux 8.8 telecommunications update service
- red hat enterprise linux 8.8 update services for sap solutions
- red hat enterprise linux 9
- red hat enterprise linux 9.2 update services for sap solutions
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sudoAlpine:v3.24 |
before 1.9.17_p2-r2 | 1.9.17_p2-r2 |
sudoAlmaLinux:9 |
before 1.9.17p2-3.el9_8.3 | 1.9.17p2-3.el9_8.3 |
sudo-python-pluginAlmaLinux:9 |
before 1.9.17p2-3.el9_8.3 | 1.9.17p2-3.el9_8.3 |
sudoAlmaLinux:10 |
before 1.9.17-10.p2.el10_2.7 | 1.9.17-10.p2.el10_2.7 |
sudo-python-pluginAlmaLinux:10 |
before 1.9.17-10.p2.el10_2.7 | 1.9.17-10.p2.el10_2.7 |
sudoAlmaLinux:8 |
before 1.9.5p2-2.el8_10 | 1.9.5p2-2.el8_10 |
sudoAzure Linux:3 |
before 1.9.17-4 | 1.9.17-4 |
sudoAlpaquita:23 |
1.9.12_p1-r1 up to 1.9.15_p5-r4 | 1.9.15_p5-r4 |
sudoAlpaquita:25 |
1.9.16_p2-r1 up to 1.9.17_p2-r3 | 1.9.17_p2-r3 |
sudoAlpaquita:stream |
1.9.13_p3-r0 up to 1.9.17_p2-r3 | 1.9.17_p2-r3 |
Show 52 moreShow less
| Package | Affected | Fixed |
|---|---|---|
sudoTuxCare:CentOS-Stream:8 |
before 1.9.5p2-1.el8.tuxcare.els3 | 1.9.5p2-1.el8.tuxcare.els3 |
sudo-develTuxCare:CentOS-Stream:8 |
before 1.9.5p2-1.el8.tuxcare.els3 | 1.9.5p2-1.el8.tuxcare.els3 |
sudoTuxCare:CentOS:8.4 |
before 1.8.29-7.el8_4.1.tuxcare.els6 | 1.8.29-7.el8_4.1.tuxcare.els6 |
sudo-develTuxCare:CentOS:8.4 |
before 1.8.29-7.el8_4.1.tuxcare.els6 | 1.8.29-7.el8_4.1.tuxcare.els6 |
sudoTuxCare:Debian:10 |
before 1.8.27-1+deb10u6+tuxcare.els3 | 1.8.27-1+deb10u6+tuxcare.els3 |
sudo-ldapTuxCare:Debian:10 |
before 1.8.27-1+deb10u6+tuxcare.els3 | 1.8.27-1+deb10u6+tuxcare.els3 |
sudoTuxCare:CentOS:8.5 |
before 1.8.29-7.el8_4.1.tuxcare.els6 | 1.8.29-7.el8_4.1.tuxcare.els6 |
sudo-develTuxCare:CentOS:8.5 |
before 1.8.29-7.el8_4.1.tuxcare.els6 | 1.8.29-7.el8_4.1.tuxcare.els6 |
sudoTuxCare:AlmaLinux:9.2 |
before 1.9.5p2-9.el9.tuxcare.els5 | 1.9.5p2-9.el9.tuxcare.els5 |
sudo-develTuxCare:AlmaLinux:9.2 |
before 1.9.5p2-9.el9.tuxcare.els5 | 1.9.5p2-9.el9.tuxcare.els5 |
sudo-python-pluginTuxCare:AlmaLinux:9.2 |
before 1.9.5p2-9.el9.tuxcare.els5 | 1.9.5p2-9.el9.tuxcare.els5 |
sudoTuxCare:AlmaLinux:9.6 |
before 1.9.5p2-10.el9_6.2.tuxcare.els2 | 1.9.5p2-10.el9_6.2.tuxcare.els2 |
sudo-develTuxCare:AlmaLinux:9.6 |
before 1.9.5p2-10.el9_6.2.tuxcare.els2 | 1.9.5p2-10.el9_6.2.tuxcare.els2 |
sudo-python-pluginTuxCare:AlmaLinux:9.6 |
before 1.9.5p2-10.el9_6.2.tuxcare.els2 | 1.9.5p2-10.el9_6.2.tuxcare.els2 |
sudoDebian:12 |
All versions, plus listed versions 1.9.13p3-11.9.13p3-1+deb12u11.9.13p3-1+deb12u21.9.13p3-1+deb12u31.9.13p3-1+deb12u4 Show 31 moreShow less1.9.13p3-21.9.13p3-31.9.14p2-11.9.15p2-11.9.15p2-21.9.15p3-11.9.15p4-11.9.15p4-21.9.15p5-11.9.15p5-21.9.15p5-31.9.15p5-3+hurd.11.9.16-11.9.16-21.9.16p1-11.9.16p2-11.9.16p2-21.9.16p2-31.9.17p1-11.9.17p2-11.9.17p2-1exp11.9.17p2-21.9.17p2-31.9.17p2-41.9.17p2-51.9.17p2-61.9.17p2-71.9.17p2-81.9.17p2-91.9.17p2-9exp11.9.17p2-9exp2 |
None known |
sudoDebian:13 |
All versions, plus listed versions 1.9.16p2-31.9.16p2-3+deb13u11.9.16p2-3+deb13u21.9.17p1-11.9.17p2-1 Show 11 moreShow less1.9.17p2-1exp11.9.17p2-21.9.17p2-31.9.17p2-41.9.17p2-51.9.17p2-61.9.17p2-71.9.17p2-81.9.17p2-91.9.17p2-9exp11.9.17p2-9exp2 |
None known |
sudoDebian:14 |
before 1.9.17p2-9, plus listed versions 1.9.16p2-31.9.17p1-11.9.17p2-11.9.17p2-1exp11.9.17p2-2 Show 6 moreShow less1.9.17p2-31.9.17p2-41.9.17p2-51.9.17p2-61.9.17p2-71.9.17p2-8 |
1.9.17p2-9 |
sudoMageia:10 From an advisory covering 2 CVEs |
before 1.9.17p1-2.1.mga10 | 1.9.17p1-2.1.mga10 |
sudoopenEuler:22.03-LTS-SP4 |
before 1.9.8p2-22.oe2203sp4 | 1.9.8p2-22.oe2203sp4 |
sudoopenEuler:24.03-LTS-SP1 |
before 1.9.15p5-9.oe2403sp1 | 1.9.15p5-9.oe2403sp1 |
sudoopenEuler:24.03-LTS-SP3 |
before 1.9.15p5-9.oe2403sp3 | 1.9.15p5-9.oe2403sp3 |
sudoopenEuler:24.03-LTS-SP4 |
before 1.9.15p5-9.oe2403sp4 | 1.9.15p5-9.oe2403sp4 |
sudoRed Hat:hummingbird:1 |
before 0:1.9.17-16.p2.2.hum1 | 0:1.9.17-16.p2.2.hum1 |
sudo-develRed Hat:hummingbird:1 |
before 0:1.9.17-16.p2.2.hum1 | 0:1.9.17-16.p2.2.hum1 |
sudo-logsrvdRed Hat:hummingbird:1 |
before 0:1.9.17-16.p2.2.hum1 | 0:1.9.17-16.p2.2.hum1 |
sudo-python-pluginRed Hat:hummingbird:1 |
before 0:1.9.17-16.p2.2.hum1 | 0:1.9.17-16.p2.2.hum1 |
sudo-debuginfoRed Hat:enterprise_linux:9::appstream |
before 0:1.9.17p2-3.el9_8.3 | 0:1.9.17p2-3.el9_8.3 |
sudo-debugsourceRed Hat:enterprise_linux:9::appstream |
before 0:1.9.17p2-3.el9_8.3 | 0:1.9.17p2-3.el9_8.3 |
sudo-python-pluginRed Hat:enterprise_linux:9::appstream |
before 0:1.9.17p2-3.el9_8.3 | 0:1.9.17p2-3.el9_8.3 |
sudo-python-plugin-debuginfoRed Hat:enterprise_linux:9::appstream |
before 0:1.9.17p2-3.el9_8.3 | 0:1.9.17p2-3.el9_8.3 |
sudoRed Hat:enterprise_linux:9::baseos |
before 0:1.9.17p2-3.el9_8.3 | 0:1.9.17p2-3.el9_8.3 |
sudo-debuginfoRed Hat:enterprise_linux:9::baseos |
before 0:1.9.17p2-3.el9_8.3 | 0:1.9.17p2-3.el9_8.3 |
sudo-debugsourceRed Hat:enterprise_linux:9::baseos |
before 0:1.9.17p2-3.el9_8.3 | 0:1.9.17p2-3.el9_8.3 |
sudo-python-plugin-debuginfoRed Hat:enterprise_linux:9::baseos |
before 0:1.9.17p2-3.el9_8.3 | 0:1.9.17p2-3.el9_8.3 |
sudo-debuginfoRed Hat:enterprise_linux:10.2 |
before 0:1.9.17-10.p2.el10_2.7 | 0:1.9.17-10.p2.el10_2.7 |
sudo-debugsourceRed Hat:enterprise_linux:10.2 |
before 0:1.9.17-10.p2.el10_2.7 | 0:1.9.17-10.p2.el10_2.7 |
sudo-python-pluginRed Hat:enterprise_linux:10.2 |
before 0:1.9.17-10.p2.el10_2.7 | 0:1.9.17-10.p2.el10_2.7 |
sudo-python-plugin-debuginfoRed Hat:enterprise_linux:10.2 |
before 0:1.9.17-10.p2.el10_2.7 | 0:1.9.17-10.p2.el10_2.7 |
sudoRed Hat:enterprise_linux:10.2 |
before 0:1.9.17-10.p2.el10_2.7 | 0:1.9.17-10.p2.el10_2.7 |
sudoRed Hat:enterprise_linux:8::baseos |
before 0:1.9.5p2-2.el8_10 | 0:1.9.5p2-2.el8_10 |
sudo-debuginfoRed Hat:enterprise_linux:8::baseos |
before 0:1.9.5p2-2.el8_10 | 0:1.9.5p2-2.el8_10 |
sudo-debugsourceRed Hat:enterprise_linux:8::baseos |
before 0:1.9.5p2-2.el8_10 | 0:1.9.5p2-2.el8_10 |
sudoRocky Linux:9 |
before 0:1.9.17p2-3.el9_8.3 | 0:1.9.17p2-3.el9_8.3 |
sudoRocky Linux:10 |
before 0:1.9.17-10.p2.el10_2.7 | 0:1.9.17-10.p2.el10_2.7 |
sudoRocky Linux:8 |
before 0:1.9.5p2-2.el8_10 | 0:1.9.5p2-2.el8_10 |
sudoUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1.8.6p3-0ubuntu31.8.8-2ubuntu11.8.8-2ubuntu21.8.9p4-1ubuntu11.8.9p4-1ubuntu2 Show 12 moreShow less1.8.9p5-1ubuntu11.8.9p5-1ubuntu1.11.8.9p5-1ubuntu1.21.8.9p5-1ubuntu1.31.8.9p5-1ubuntu1.41.8.9p5-1ubuntu1.5+esm11.8.9p5-1ubuntu1.5+esm21.8.9p5-1ubuntu1.5+esm31.8.9p5-1ubuntu1.5+esm51.8.9p5-1ubuntu1.5+esm61.8.9p5-1ubuntu1.5+esm71.8.9p5-1ubuntu1.5+esm8 |
None known |
sudoUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.8.12-1ubuntu31.8.16-0ubuntu11.8.16-0ubuntu1.11.8.16-0ubuntu1.21.8.16-0ubuntu1.3 Show 10 moreShow less1.8.16-0ubuntu1.41.8.16-0ubuntu1.51.8.16-0ubuntu1.61.8.16-0ubuntu1.71.8.16-0ubuntu1.81.8.16-0ubuntu1.91.8.16-0ubuntu1.101.8.16-0ubuntu1.10+esm11.8.16-0ubuntu1.10+esm21.8.16-0ubuntu1.10+esm3 |
None known |
sudoUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.8.20p2-1ubuntu11.8.21p2-2ubuntu11.8.21p2-3ubuntu11.8.21p2-3ubuntu1.11.8.21p2-3ubuntu1.2 Show 5 moreShow less1.8.21p2-3ubuntu1.31.8.21p2-3ubuntu1.41.8.21p2-3ubuntu1.51.8.21p2-3ubuntu1.61.8.21p2-3ubuntu1.6+esm1 |
None known |
sudoUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.8.27-1ubuntu41.8.29-1ubuntu11.8.31-1ubuntu11.8.31-1ubuntu1.11.8.31-1ubuntu1.21.8.31-1ubuntu1.41.8.31-1ubuntu1.51.8.31-1ubuntu1.5+esm1 |
None known |
sudoUbuntu:22.04:LTS |
before 1.9.9-1ubuntu2.7, plus listed versions 1.9.5p2-3ubuntu21.9.9-1ubuntu21.9.9-1ubuntu2.11.9.9-1ubuntu2.21.9.9-1ubuntu2.31.9.9-1ubuntu2.41.9.9-1ubuntu2.51.9.9-1ubuntu2.6 |
1.9.9-1ubuntu2.7 |
sudoUbuntu:24.04:LTS |
before 1.9.15p5-3ubuntu5.24.04.4, plus listed versions 1.9.14p2-1ubuntu11.9.15p5-3ubuntu11.9.15p5-3ubuntu31.9.15p5-3ubuntu41.9.15p5-3ubuntu51.9.15p5-3ubuntu5.24.04.11.9.15p5-3ubuntu5.24.04.21.9.15p5-3ubuntu5.24.04.3 |
1.9.15p5-3ubuntu5.24.04.4 |
sudoUbuntu:26.04:LTS |
before 1.9.17p2-1ubuntu3.2, plus listed versions 1.9.17p2-1ubuntu11.9.17p2-1ubuntu21.9.17p2-1ubuntu31.9.17p2-1ubuntu3.1 |
1.9.17p2-1ubuntu3.2 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | Ermensonx/sudotimewarp-cve-2026-96512- | 2026-09-25 |
| PoC in GitHub | abraxas/CVE-2026-96512 | 2026-09-25 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| affected, facts | OSV | |
| affected | OSV | |
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-96512 is a high vulnerability (CVSS 7.8) in Red Hat Enterprise Linux 10, published September 23, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 25th percentile. Fixed in sudo 1.9.17_p2-r2.
References
access.redhat.com/errata/RHSA-2026:71609
Show 51 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=2539327
github.com/sudo-project/sudo/commit/1820a349687522f51023d1ae5925125f59679a8c
openwall.com/lists/oss-security/2026/09/24/4
nvd.nist.gov/vuln/detail/CVE-2026-96512
security.alpinelinux.org/vuln/CVE-2026-96512
errata.almalinux.org/9/ALSA-2026-75571.html
docs.bell-sw.com/security/cves/CVE-2026-96512
errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1791552454.html
catalog.redhat.com/software/containers
security-tracker.debian.org/tracker/CVE-2026-96512
advisories.mageia.org/MGASA-2026-0531.html
bugs.mageia.org/show_bug.cgi?id=36362
ubuntu.com/security/notices/USN-8803-1
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-4258
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_71609.json
cve.org/CVERecord?id=CVE-2026-96512
errata.rockylinux.org/RLSA-2026:75571