What is the CVSS score of CVE-2026-14459?

CVE-2026-14459 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Pardus Software are affected by CVE-2026-14459?

Turkish Pardus Linux distributions running pardus-software version 1.0.4 and earlier contain a high-severity local privilege escalation vulnerability allowing system users to gain complete host…. A patch is available.

How to fix or mitigate CVE-2026-14459?

24 hours: Inventory systems running pardus-software version 1.0.4 or earlier; prioritize systems with multiple local user accounts. 7 days: Deploy pardus-software version 1.0.5 across all affected Pardus Linux systems and confirm completion in asset management system. 30 days: Verify 100% patch compliance through automated scanning and audit local account provisioning policies.

Pardus Software CVE-2026-14459

EUVD-2026-41550 HIGH

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)

2026-07-03 TR-CERT

GHSA-rrqp-52wf-rr49

Code Injection Pardus Software Tubitak Bilgem Software Technologies Research Institute

8.8

CVSS 3.1 · Vendor: TR-CERT

Severity by source

Vendor (TR-CERT) PRIMARY

8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (TR-CERT) · only source for this CVE.

CVSS VectorVendor: TR-CERT

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 03, 2026 - 16:01 EUVD

Analysis Generated

Jul 03, 2026 - 15:15 vuln.today

DescriptionCVE.org

Improper neutralization of argument delimiters in a command ('argument injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-software allows Argument Injection.

This issue affects pardus-software: from <= 1.0.4 before 1.0.5.

AnalysisAI

Local privilege escalation via argument injection in TUBITAK BILGEM's pardus-software (the software-center application for the Turkish Pardus Linux distribution) affects all versions up to and including 1.0.4. A low-privileged local user can smuggle attacker-controlled argument delimiters into a command the application invokes with elevated privileges, yielding full compromise of the host (confidentiality, integrity, and availability all high) with no user interaction. No public exploit has been identified at time of analysis, and the issue is not on CISA KEV; it is fixed in version 1.0.5.