Ubuntu releases Sudo security updates for 18.04 and 20.04 LTS to fix time-restriction bypass

Canonical has issued security updates for the Sudo utility to address CVE-2026-96512, which affects time-based access controls. The flaw specifically impacts sudoers rules that utilize NOTBEFORE or NOTAFTER directives with timestamps that lack a trailing timezone indicator.

These updates are specifically targeted at Ubuntu 18.04 LTS (Bionic) and Ubuntu 20.04 LTS (Focal) users. Because these versions are in the Extended Security Maintenance (ESM) phase, the fixes are provided through the Ubuntu Pro subscription service.

Technical breakdown of CVE-2026-96512

• Vulnerability Class: Local privilege escalation via bypass of time-based access restrictions.
• Root Cause: Improper handling of timestamps in sudoers rules when the trailing timezone indicator is omitted from NOTBEFORE or NOTAFTER directives.
• Attack Vector: A local attacker can manipulate the TZ environment variable to execute commands outside of the authorized time window.
• Affected Packages: The fix applies to both the core sudo package and the sudo-ldap component.

Why it matters

System administrators managing legacy Ubuntu environments must utilize Ubuntu Pro to receive these critical security patches. This vulnerability highlights the risks of relying on environment variables for security-sensitive time constraints in sudoers configurations.