Pardus Update CVE-2026-16287

Exploitation requires local access with a low-privileged authenticated account (CVSS PR:L, AV:L), with no user interaction from a victim (UI:N). The attacker must be able to reach and supply input to the pardus-update component on an affected version (0.6.6 through 0.7.0-exclusive) running on a Pardus system. Limiting factors: the attacker needs an existing local foothold - there is no network-facing vector - and the target must run a vulnerable pardus-update version; systems on 0.7.0+ or without pardus-update installed are not exploitable. The exact injectable feature/parameter is not specified in the description and should be confirmed via the TR-CERT advisory.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a locally exploitable flaw requiring low privileges but no user interaction, with high impact across confidentiality, integrity, and availability - consistent with a low-privileged local user escalating to full host control through a privileged update process. Real-world risk is tempered by the local attack vector: an attacker must already have a foothold on the system, so this is an escalation/post-exploitation primitive rather than a remotely wormable issue. No EPSS score, KEV listing, POC, or SSVC decision data was supplied; there is no public exploit identified at time of analysis and no evidence of active exploitation. Priority should be judged as moderate-to-high specifically for organizations running Pardus on multi-user or shared systems, and lower where hosts are single-administrator. Note the description says only 'OS Command Injection' without naming the exact injectable feature - the precise attack surface is not confirmed from available data and should be verified against the TR-CERT advisory.

A low-privileged local user on a Pardus workstation supplies a maliciously crafted input (e.g., a package name, URL, or parameter containing shell metacharacters) to pardus-update, which passes it unsanitized into an OS command executed by the privileged update process. The injected command runs with the elevated privileges of that process, giving the attacker code execution and effective privilege escalation to root. No public proof-of-concept has been identified, and exploitation requires the attacker to already have a local account.