What is the CVSS score of CVE-2026-14460?

CVE-2026-14460 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Pardus Software are affected by CVE-2026-14460?

TUBITAK BILGEM's pardus-software (Pardus Linux software center) versions up to 1.0.4 are vulnerable to local privilege escalation that enables low-privilege users to achieve full system compromise.. A patch is available.

How to fix or mitigate CVE-2026-14460?

Within 24 hours: Identify all systems running pardus-software and document current versions via package manager queries. Within 7 days: Test and deploy pardus-software version 1.0.5 across development and staging environments. Within 30 days: Complete production deployment of version 1.0.5 to all affected systems and verify via inventory scans.

Pardus Software CVE-2026-14460

EUVD-2026-41552 HIGH

Missing Authorization (CWE-862)

2026-07-03 TR-CERT

GHSA-8725-rp9g-qx9v

Authentication Bypass Pardus Software Tubitak Bilgem Software Technologies Research Institute

8.8

CVSS 3.1 · Vendor: TR-CERT

Severity by source

Vendor (TR-CERT) PRIMARY

8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Local low-privileged user (AV:L/PR:L) exploits a missing authz check with no interaction; argument injection into a privileged backend crosses a privilege boundary (S:C) yielding full root-level C/I/A impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (TR-CERT).

CVSS VectorVendor: TR-CERT

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 03, 2026 - 16:01 EUVD

Analysis Generated

Jul 03, 2026 - 15:17 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-software allows Argument Injection.

This issue affects pardus-software: from <= 1.0.4 before 1.0.5.

AnalysisAI

Local privilege escalation via argument injection in TUBITAK BILGEM's pardus-software (the Pardus Linux application/software center) affects versions up to and including 1.0.4 and is fixed in 1.0.5. A low-privileged local user can abuse a missing authorization check (CWE-862) to inject attacker-controlled arguments into a privileged backend operation, and because the CVSS scope is Changed with High confidentiality, integrity, and availability impact, this realistically yields code execution or full compromise of the underlying system. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the 8.8 CVSS and scope change make it a serious local escalation issue.

Technical ContextAI

Pardus is a Debian-based Linux distribution developed by TUBITAK BILGEM, and pardus-software is its graphical software/application center used to browse and install packages. The root cause is CWE-862 (Missing Authorization): a privileged operation exposed by the tool does not properly verify the caller's authorization before acting, allowing that path to be reached by an unprivileged local user. This missing check is combined with an argument-injection weakness, meaning user-influenced input is passed as command-line arguments to an underlying privileged process (typically a package-management or helper backend such as apt/dpkg or a PolicyKit-mediated action), so injected flags/arguments alter the privileged command's behavior. The single CPE (cpe:2.3:a:tubitak_bilgem_software_technologies_research_institute:pardus-software:*) confirms the affected component is the pardus-software application itself rather than the wider OS.

RemediationAI

Upgrade pardus-software to version 1.0.5, which is the vendor-released patch that remediates this vulnerability; on Pardus systems this is best done via the distribution's package updates (apt) so the fixed package replaces the vulnerable 1.0.4-and-earlier builds. Consult the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0497 for vendor guidance. Until 1.0.5 is deployed, reduce exposure by restricting interactive/local access to the affected hosts so untrusted or low-privileged users cannot reach the software center, and, where feasible, remove or disable the pardus-software GUI on multi-user or shared systems that do not require it - the trade-off is loss of the graphical package-management convenience for legitimate users, who would then rely on standard apt tooling. Because exploitation is local, tightening local account provisioning and monitoring for anomalous privileged package-manager invocations provides additional compensating coverage.