What is the CVSS score of CVE-2026-12250?

CVE-2026-12250 has a CVSS 3.1 base score of 7.9 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Pardus Domain Joiner are affected by CVE-2026-12250?

Pardus Domain Joiner versions 0.5.2-0.5.3 expose directory-service credentials (Active Directory or LDAP bind accounts) to local system users through process-argument leakage, creating credential…. A patch is available.

How to fix or mitigate CVE-2026-12250?

Within 24 hours: Identify all Pardus systems using Pardus Domain Joiner versions 0.5.2-0.5.3. Within 7 days: Upgrade all affected systems to Pardus Domain Joiner version 0.5.4. Within 30 days: Reset domain-join and LDAP service credentials; audit logs for suspicious use of exposed credentials.

Pardus Domain Joiner CVE-2026-12250

EUVD-2026-41762 HIGH

Invocation of Process Using Visible Sensitive Information (CWE-214)

2026-07-05 TR-CERT

GHSA-9pj6-hfxh-g9g8

Information Disclosure Pardus Domain Joiner

7.9

CVSS 3.1 · Vendor: TR-CERT

Severity by source

Vendor (TR-CERT) PRIMARY

7.9 HIGH

AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Primary rating from Vendor (TR-CERT) · only source for this CVE.

CVSS VectorVendor: TR-CERT

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jul 05, 2026 - 16:01 EUVD

Analysis Generated

Jul 05, 2026 - 15:22 vuln.today

DescriptionCVE.org

Invocation of process using visible sensitive information vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Domain Joiner allows Excavation.

This issue affects Pardus Domain Joiner: from 0.5.2 before 0.5.4.

AnalysisAI

Sensitive information exposure in Pardus Domain Joiner (versions 0.5.2 up to but not including 0.5.4) lets a local low-privileged user harvest secrets — most plausibly domain-join credentials — that the tool passes as visible arguments when invoking a child process. TUBITAK BILGEM's utility enrolls Pardus (a Turkish Debian-based distribution) endpoints into a directory/domain, so the leaked material can be Active Directory or LDAP bind credentials. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the fix in 0.5.4 confirms the issue is vendor-acknowledged.