What is the CVSS score of CVE-2026-12250?

CVE-2026-12250 has a CVSS 3.1 base score of 7.9 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Pardus Domain Joiner are affected by CVE-2026-12250?

Pardus Domain Joiner versions 0.5.2-0.5.3 expose directory-service credentials (Active Directory or LDAP bind accounts) to local system users through process-argument leakage, creating credential…. A patch is available.

How to fix or mitigate CVE-2026-12250?

Within 24 hours: Identify all Pardus systems using Pardus Domain Joiner versions 0.5.2-0.5.3. Within 7 days: Upgrade all affected systems to Pardus Domain Joiner version 0.5.4. Within 30 days: Reset domain-join and LDAP service credentials; audit logs for suspicious use of exposed credentials.

Pardus Domain Joiner CVE-2026-12250

EUVD-2026-41762 HIGH

Invocation of Process Using Visible Sensitive Information (CWE-214)

2026-07-05 TR-CERT

GHSA-9pj6-hfxh-g9g8

Information Disclosure Pardus Domain Joiner

7.9

CVSS 3.1 · Vendor: TR-CERT

Severity by source

Vendor (TR-CERT) PRIMARY

7.9 HIGH

AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Primary rating from Vendor (TR-CERT) · only source for this CVE.

CVSS VectorVendor: TR-CERT

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jul 05, 2026 - 16:01 EUVD

Analysis Generated

Jul 05, 2026 - 15:22 vuln.today

DescriptionCVE.org

Invocation of process using visible sensitive information vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Domain Joiner allows Excavation.

This issue affects Pardus Domain Joiner: from 0.5.2 before 0.5.4.

AnalysisAI

Sensitive information exposure in Pardus Domain Joiner (versions 0.5.2 up to but not including 0.5.4) lets a local low-privileged user harvest secrets — most plausibly domain-join credentials — that the tool passes as visible arguments when invoking a child process. TUBITAK BILGEM's utility enrolls Pardus (a Turkish Debian-based distribution) endpoints into a directory/domain, so the leaked material can be Active Directory or LDAP bind credentials. …