What is the CVSS score of CVE-2026-11765?

CVE-2026-11765 has a CVSS 3.1 base score of 3.3 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-11765?

Yes, a patch is available for CVE-2026-11765. Update the affected software to the latest version immediately.

Pardus Pen CVE-2026-11765

EUVD-2026-76102 LOW

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)

2026-09-11 TR-CERT

GHSA-8jgw-pvr8-c8v3

Code Injection Pardus Pen Tubitak Bilgem Software Technologies Research Institute

3.3

CVSS 3.1 · NVD

Severity by source

Vendor (TR-CERT) PRIMARY

LOW

qualitative

NVD

3.3 LOW

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

3.3 LOW

Local attack vector with low-privilege user required; only limited integrity impact from argument manipulation; no confidentiality or availability consequence.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TR-CERT).

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Sep 11, 2026 - 15:02 EUVD

Analysis Generated

Sep 11, 2026 - 13:51 vuln.today

DescriptionNVD

Improper neutralization of argument delimiters in a command ('argument injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Pen allows Argument Injection.

This issue affects Pardus Pen: before 4.2.1.

AnalysisAI

Argument injection in Pardus Pen before version 4.2.1 allows a local, low-privileged user to inject unsanitized argument delimiters into an underlying command invocation, yielding limited integrity impact. The flaw (CWE-88) is strictly local in scope-CVSS AV:L/PR:L-and carries no confidentiality or availability consequence per the published vector. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires an interactive local session with at least low-privilege (standard user) account access on a system running Pardus Pen before 4.2.1. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 3.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) accurately captures a genuinely low-severity issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade to Pardus Pen 4.2.1 or later, which resolves the argument injection flaw per the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1079. … Detailed patch versions, workarounds, and compensating controls in full report.