What is the CVSS score of CVE-2026-15599?

CVE-2026-15599 has a CVSS 3.1 base score of 3.3 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-15599?

Yes, a patch is available for CVE-2026-15599. Update the affected software to the latest version immediately.

pardus-domain-joiner CVE-2026-15599

EUVD-2026-53872 LOW

Unverified Ownership (CWE-283)

2026-08-06 iletisim@usom.gov.tr

GHSA-6cpw-v4wr-4622

Information Disclosure

3.3

CVSS 3.1 · Vendor: usom

Severity by source

Vendor (usom) PRIMARY

3.3 LOW

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

4.4 MEDIUM

C:L added over official C:N to reconcile the conflicting Information Disclosure tag; all other metrics align with local low-privilege access and no integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (usom).

CVSS VectorVendor: usom

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Patch available

Aug 06, 2026 - 14:01 EUVD

Analysis Generated

Aug 06, 2026 - 13:31 vuln.today

DescriptionCVE.org

Unverified ownership vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-domain-joiner allows Privilege Abuse.

This issue affects pardus-domain-joiner: before 0.5.5.

AnalysisAI

Local privilege abuse in pardus-domain-joiner (TÜBİTAK BİLGEM Software Technologies Research Institute) before version 0.5.5 exposes Pardus Linux systems to unauthorized resource access through unverified ownership checks (CWE-283). A locally authenticated user with low privileges can trigger a code path where ownership of a resource is not validated before access or privileged operations are permitted, enabling privilege abuse. No public exploit code or active exploitation has been identified; the CVSS score of 3.3 reflects limited real-world impact confined to local sessions on Pardus Linux systems.

Technical ContextAI

pardus-domain-joiner is a domain-joining utility developed by TÜBİTAK BİLGEM Software Technologies Research Institute for Pardus Linux, enabling the operating system to enroll in Windows Active Directory domains. The root cause is CWE-283 (Unverified Ownership): the application fails to confirm that a resource - such as a file, socket, process handle, or configuration object - is owned by the expected principal before granting access or performing privileged operations. Domain-joining software is particularly sensitive to this class of flaw because such tools routinely handle Kerberos tickets, LDAP credentials, PAM modules, and SSSD configuration. No CPE string was provided in the intelligence data. All pardus-domain-joiner versions prior to 0.5.5 are confirmed affected.

RemediationAI

Upgrade pardus-domain-joiner to version 0.5.5 or later, which is confirmed as the remediated release per the NVD advisory data (all versions before 0.5.5 are vulnerable). The vendor advisory is available at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0770 and should be consulted for package distribution details specific to Pardus Linux repositories. If an immediate upgrade is not feasible, restrict interactive local shell access on affected systems to trusted administrative accounts only - this narrows the pool of users capable of triggering the unverified ownership path, though it does not eliminate the vulnerability. Temporarily disabling domain-join operations is a more disruptive compensating control that eliminates the attack surface at the cost of blocking domain authentication for all users on that host.