CVE-2026-96512

Executive Summary

CVE-2026-96512 is a local time-of-check logic flaw in sudo (CWE-863, Incorrect Authorization) in which sudoers rules that use NOTBEFORE/NOTAFTER time-based access restrictions with timestamps that omit the trailing Z timezone indicator are evaluated using the TZ environment variable inherited from the invoking user. Because sudo is a setuid-root program, an unprivileged local user can set TZ to an extreme offset and shift the effective authorization window by roughly 25 hours, causing already-expired rules to be treated as active. The impact is time-window authorization bypass for command execution as a privileged target user — authentication itself is not bypassed, and the flaw does not grant credentials the caller would not otherwise possess.

Technical Analysis

The defect is an authorization-logic error rather than a memory-safety or injection issue. sudo supports time-bounded privilege rules in sudoers via the NOTBEFORE and NOTAFTER tags, which gate whether a rule is considered valid at the moment of evaluation. When the configured timestamp omits the trailing Z (Zulu/UTC) designator, the time value is not anchored to UTC. In that state, the comparison between the current time and the rule's boundary is resolved against the local time zone as reported to the process — and that value is derived from the TZ environment variable of the calling, unprivileged user.

Two properties combine to make this exploitable:

1. TZ is attacker-controlled. TZ is an ordinary environment variable set by the invoking shell/user and is inherited across the execve boundary into sudo. No privilege is required to set it.
2. Extreme offsets widen the error to ~25 hours. Valid time-zone offsets range up to UTC+14 (e.g. Pacific/Kiritimati) and UTC−12, and named zones in the TZ database can be selected by the unprivileged user. The resulting skew between the wall-clock time assumed by the rule and the time sudo actually evaluates can approach ±25 hours — enough to move an expired validity window back into the present.

The consequence is a time-of-check failure: the authorization predicate is evaluated against a manipulated clock context rather than an absolute, UTC-anchored reference. Once the predicate incorrectly returns "valid," the rule is treated as in force and the command is matched and executed under the rule's run-as identity. The core authentication step (the user proving identity, e.g. via password or configured NOPASSWD) is unchanged; only the temporal authorization gate misfires. The most likely failure modes are (a) a naive comparison that uses local time when the Z suffix is absent instead of rejecting the unanchored timestamp, or (b) parsing that treats the absent Z as "assume local," thereby making evaluation dependent on TZ.

Attack surface: local, interactive or scripted execution on a host where sudo is installed and at least one sudoers rule uses NOTBEFORE/NOTAFTER with a non-Z-suffixed timestamp. Rules written with explicit Z (UTC-anchored) timestamps are, per the description, not affected, because the evaluation no longer depends on the inherited local time zone.

No CVE-specific patch, commit, advisory, or fixed version was available at the time of writing. No public PoC or exploit code was observed. The analysis above is derived strictly from the NVD description; no function names, file paths, or internal symbol names are asserted because none were provided.

Exploitation Scenarios

No public proof-of-concept exists; the following chain is inferred at the vulnerability-class level from the NVD description.

1. Reconnaissance / target identification. The attacker has local (unprivileged) access — a low-privileged shell, CI runner, container, or legitimate but limited account on a multi-user host. They determine whether sudo policies rely on time-bounded rules by inspecting policy affordances available to them (e.g. attempting commands and observing whether time restrictions influence outcomes, or reviewing any world-readable policy references). The key precondition is the presence of a NOTBEFORE/NOTAFTER rule whose timestamp lacks a trailing Z.

2. Triggering the flaw class. The attacker sets the TZ environment variable to an extreme time-zone offset (up to roughly UTC+14 / UTC−12, and any named zone that yields a comparable skew) in the shell that will invoke sudo. Because TZ is a normal, user-settable variable, no privileges are needed to control it.

3. Payload / execution. The attacker then invokes the specific privileged command that the time-bounded sudoers rule governs. sudo evaluates the NOTBEFORE/NOTAFTER boundary using the attacker-influenced local time context. If the ~25-hour skew pushes the current evaluated time back inside the rule's validity window, an expired rule is treated as valid and the command executes under the identity specified by that rule. No exploit payload, shellcode, or malformed input is required — the "payload" is the environment manipulation plus the target command invocation.

4. Post-exploitation impact. Per the CVSS vector, the successful outcome is high confidentiality, integrity, and availability impact (C:H/I:H/A:H) within the scope of the rule's run-as target: the attacker gains the ability to run otherwise time-restricted commands as the privileged account, at a time they were not authorized to do so. This can enable further enumeration, configuration changes, data access, or lateral movement consistent with that privileged identity. Authentication is not bypassed — the attacker still satisfies the normal authentication/NOPASSWD requirement — so the win is narrowly the erosion of time-based authorization, not credential theft or privilege escalation beyond the rule's intended target.

The attack is repeatable and low-noise: it requires no network traffic, no malformed input, and no persistent modification to system files, making it straightforward to perform from a single local session.

Impact Assessment

CVE-2026-96512 carries a CVSS v3.1 base score of 7.8 (High) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

• Attack Vector: Local (L). Exploitation requires a foothold on the target host; there is no remote vector. This limits the exposed population to systems that already grant an attacker some level of local access.
• Attack Complexity: Low (L). The manipulation consists solely of setting an environment variable and running a command — no race condition, no memory grooming, no special tooling.
• Privileges Required: Low (L). Any unprivileged local user account suffices.
• User Interaction: None (N). No victim action is required.
• Scope: Unchanged (U). The impact remains within the security authority of the vulnerable sudo component and the target account defined by the rule.
• Confidentiality / Integrity / Availability: High (H) each. Where a time-bounded rule governs a highly privileged command or run-as account, successful execution can expose data, permit configuration changes, and disrupt services consistent with that identity.

Affected systems: any host running a vulnerable sudo build whose policy includes NOTBEFORE/NOTAFTER restrictions with non-Z timestamps — commonly seen in enterprises enforcing "change window" or "break-glass" access, in compliance-driven access scheduling, and in automated/CI environments using time-bound delegation. Exposure scales with how broadly such rules are deployed and how many local accounts exist.

Blast radius: local and host-scoped per affected machine, but potentially broad across a fleet if a single policy template with non-Z timestamps is distributed widely. Because the effect is confined to the authorization window (not authentication), it does not yield credentials or root shell access beyond what the faulty rule itself already grants — but that is often exactly the high-value, tightly time-restricted path an organization intended to keep closed outside its window. Business impact includes loss of the intended control (approval-window enforcement), audit/compliance findings (the control that auditors relied on no longer holds), and elevated risk if the time-restricted rule protects sensitive systems.

No EPSS score has been published, no CISA KEV listing exists, and there is no evidence of in-the-wild exploitation at the time of writing — the practical risk is currently governed by local-attacker prerequisites and the difficulty of discovering affected non-Z policy timestamps.

Detection Guidance

Sigma Rule

title: Potential Sudo NOTBEFORE/NOTAFTER Time-Zone Authorization Bypass (TZ Manipulation)
id: 8f3c1b7a-2d5e-4a91-9c6f-0b7d4e2a1f55
status: experimental
description: Detects execution of sudo with a manipulated/abnormal TZ environment variable that may shift time-based sudoers authorization windows.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-96512
author: Threat Intelligence
date: 2026/01/01
logsource:
  product: linux
  service: auditd
detection:
  selection_proc:
    type: EXECVE
    a0: 'sudo'
  selection_tz_offsets:
    - 'TZ=Etc/GMT+1'
    - 'TZ=Etc/GMT+2'
    - 'TZ=Etc/GMT+3'
    - 'TZ=Etc/GMT+4'
    - 'TZ=Etc/GMT+5'
    - 'TZ=Etc/GMT+6'
    - 'TZ=Etc/GMT+7'
    - 'TZ=Etc/GMT+8'
    - 'TZ=Etc/GMT+9'
    - 'TZ=Etc/GMT+10'
    - 'TZ=Etc/GMT+11'
    - 'TZ=Etc/GMT+12'
    - 'TZ=Pacific/Kiritimati'
  condition: selection_proc and selection_tz_offsets
fields:
  - uid
  - a0
  - a1
  - a2
level: medium
tags:
  - attack.privilege_escalation
  - attack.t1548
  - cve.2026.96512

YARA Rule

rule CVE_2026_96512_Sudo_TZ_Authorization_Bypass_Indicator
{
    meta:
        description = "Detects scripts or command wrappers that export an extreme TZ offset preceding a sudo invocation, consistent with CVE-2026-96512 time-window authorization manipulation"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-96512"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $tz_export = /TZ=[A-Za-z0-9_\/\+\-]{1,32}/ ascii wide nocase
        $sudo     = "sudo " ascii wide nocase
        $etcgmt   = "Etc/GMT" ascii wide nocase
        $kiri     = "Kiritimati" ascii wide nocase

    condition:
        $tz_export and $sudo and ( $etcgmt or $kiri )
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET 22 ( \
  msg:"CVE-2026-96512 Possible sudo time-window authorization bypass via TZ manipulation (SSH session)"; \
  flow:established,to_server; \
  content:"TZ="; nocase; \
  content:"Etc/GMT"; nocase; distance:0; within:32; \
  content:"sudo"; nocase; distance:0; within:64; \
  classtype:attempted-admin; \
  sid:202696512; rev:1; \
  reference:cve,2026-96512; \
  reference:url,nvd.nist.gov/vuln/detail/CVE-2026-96512; \
  metadata:service ssh;)

Note: this rule is opportunistic — it flags TZ manipulation visible in interactive SSH sessions and cannot detect purely local activity. Local auditd/eBPF telemetry (see Sigma rule) is the reliable detection channel.

Elastic Detection

sequence by host.id, user.id with maxspan=30s
  [ process where event.type == "start" and process.name == "sudo" and
      process.env_vars like~ ("*TZ=Etc/GMT+*", "*TZ=Pacific/Kiritimati*", "*TZ=Etc/GMT-*") ]
  [ process where event.type == "start" and process.parent.name == "sudo" ]

Companion query (environment enrichment) for environments where process.env_vars is populated:

process where event.type == "start" and process.name == "sudo" and
  process.env_vars regex~ "TZ=(Etc/GMT[+-](1[0-2]|[1-9])|Pacific/Kiritimati)"

Splunk SPL Query

index=linux sourcetype=auditd event.type=EXECVE OR tag=process
| search "sudo" AND ( "TZ=Etc/GMT+" OR "TZ=Etc/GMT-" OR "TZ=Pacific/Kiritimati" )
| stats count min(_time) as first_seen max(_time) as last_seen
        values(field1) as cmdline dc(host) as hosts
        by uid, host
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="sudo,cve-2026-96512,">
  <rule id="100965" level="10">
    <if_sid>80700</if_sid>
    <field name="audit.command">sudo</field>
    <regex>TZ=Etc/GMT[+-](1[0-2]|[1-9])|TZ=Pacific/Kiritimati</regex>
    <description>CVE-2026-96512: sudo invoked with extreme TZ offset - possible time-based authorization window manipulation</description>
    <mitre>
      <id>T1548</id>
    </mitre>
    <group>privilege_escalation,audit,</group>
  </rule>
</group>

Note: rule IDs/signature parents (80700) are illustrative placeholders and must be mapped to the local Wazuh ruleset; the detection logic (sudo execution carrying an extreme TZ offset) is the operative content.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED). No vendor fix, workaround, fixed version, or patch reference was identified by any tracked source at the time of writing. No affected-version range has been published. Treat all currently deployed sudo builds on hosts using NOTBEFORE/NOTAFTER rules as potentially affected until vendor guidance confirms otherwise.

1. Immediate mitigations (reduce exposure now).

   • Audit sudoers for time-bounded rules. Identify every NOTBEFORE/NOTAFTER restriction and normalize timestamps to explicit UTC by appending the trailing Z. Anchored timestamps remove the inherited-local-time dependency that underlies the flaw.
   • Where a rule cannot be re-anchored, restrict its use or temporarily disable the time-bounded delegation until a fix is available.
   • Do not rely on time-bounded rules as a sole control for sensitive commands in the interim; pair them with requiretty, command path pinning, tight runas scoping, and least-privilege accounts.
   • Constrain local-account attack surface — reduce the number of unprivileged local users on hosts that carry time-restricted sudo rules, and monitor for anomalous TZ values in process telemetry (see Detection Guidance).
   • Note the limitation: because sudo is setuid-root, per-user shell hardening around TZ is not a complete mitigation; policy normalization is the primary control.

2. Patch / upgrade steps (once available).

   • Monitor the sudo project's advisories and release notes and the NVD record for CVE-2026-96512 for a fixed version; the sudo project historically publishes CVE-specific advisories with fixed release numbers.
   • On availability, upgrade sudo to the first release that documents a fix for this CVE, using the distribution vendor's package (e.g. apt/dnf/zypper security update) or a vendor-tested source build.
   • Validate after upgrade: confirm the fixed build rejects or UTC-anchors non-Z timestamps and that evaluation is independent of the caller's TZ. Re-test each normalized sudoers rule.

3. Long-term hardening.

   • Standardize timestamp canon: enforce a policy that all NOTBEFORE/NOTAFTER timestamps carry an explicit Z (or offset), validated in configuration review and in CI for policy-as-code.
   • Policy-as-code review gates: lint sudoers files for non-UTC or non-Z timestamps as a mandatory pre-deployment check.
   • Reduce time-window reliance: prefer just-in-time, short-lived credential elevation (e.g. ephemeral privileged sessions) over long-lived time-bounded rules where feasible.
   • Telemetry coverage: ensure host audit logging captures EXECVE with environment context (auditd/eBPF) so TZ manipulation by sudo callers is detectable and alertable.
   • Vulnerability management: track CVE-2026-96512 to closure; since no EPSS/KEV signal exists yet, prioritize by the presence of affected sudoers rules rather than by score alone.

References

1. NVD — CVE-2026-96512: https://nvd.nist.gov/vuln/detail/CVE-2026-96512
2. MITRE CWE-863 — Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
3. MITRE ATT&CK T1548 — Abuse Elevation Control Mechanism: https://attack.mitre.org/techniques/T1548/
4. Sudo project site and release/advisory notices (monitor for a CVE-2026-96512 fix): https://www.sudo.ws/
5. FIRST EPSS (score not yet published for this CVE): https://www.first.org/epss/

No CISA KEV listing, no public proof-of-concept, no exploit code, and no observed threat-actor exploitation were identified for CVE-2026-96512 at the time of writing.