What is the CVSS score of CVE-2026-16287?

CVE-2026-16287 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.8%.

Which versions of Pardus Update are affected by CVE-2026-16287?

Pardus-update, the update manager component in the Turkish Pardus distribution, contains a local privilege escalation vulnerability (CVSS 7.8) in versions 0.6.6 through 0.6.x allowing authenticated…. A patch is available.

How to fix or mitigate CVE-2026-16287?

Within 24 hours, inventory all systems running affected Pardus pardus-update versions 0.6.6 through 0.6.x and document local user access policies on each system. Within 7 days, restrict non-administrative local user account access on affected systems, enable kernel audit logging for privilege escalation attempts and suspicious update manager activity, and deploy real-time alerting for detected abuse patterns. Within 30 days, monitor Pardus vendor advisories and security channels for patch release; prepare and test deployment automation for rapid rollout to all affected systems upon vendor patch availability.

Pardus Update CVE-2026-16287

EUVD-2026-47933 HIGH

OS Command Injection (CWE-78)

2026-07-23 TR-CERT

GHSA-48px-72pc-9gfw

Command Injection Pardus Update Tubitak Bilgem Software Technologies Research Institute

7.8

CVSS 3.1 · Vendor: TR-CERT

Severity by source

Vendor (TR-CERT) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local command injection needing a low-privileged account (AV:L, PR:L, AC:L) into a privileged update process yields full C/I/A compromise with no user interaction.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TR-CERT).

CVSS VectorVendor: TR-CERT

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 23, 2026 - 11:32 EUVD

Analysis Generated

Jul 23, 2026 - 09:03 vuln.today

CVE Published

Jul 23, 2026 - 07:44 cve.org

HIGH 7.8

DescriptionCVE.org

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-update allows OS Command Injection.

This issue affects pardus-update: from 0.6.6 before 0.7.0.

AnalysisAI

Local privilege-relevant OS command injection in pardus-update (the update manager component of the Turkish national Debian-based distribution Pardus) affects versions 0.6.6 up to but not including 0.7.0, allowing an authenticated local user to inject and execute arbitrary operating system commands via improperly neutralized special characters. Because update tooling typically runs with elevated privileges, successful exploitation can yield full confidentiality, integrity, and availability compromise of the host. Reported by Turkey's national CSIRT (TR-CERT); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected component, pardus-update, is the software update/package management front-end distributed with Pardus, a Debian-derived Linux distribution developed by TÜBİTAK BİLGEM (the informatics and information security research institute of Turkey's national research council). The root cause is CWE-78 (improper neutralization of special elements used in an OS command), meaning user- or context-controlled input is passed into a shell or command interpreter without adequate sanitization or argument separation. The single CPE (cpe:2.3:a:tubitak_bilgem_software_technologies_research_institute:pardus-update) confirms the flaw is in the application layer of this specific update utility rather than an underlying library. Update managers commonly shell out to package tooling (apt/dpkg) and often execute with root or elevated privileges, which is why an injection here maps to high impact across all three security properties.

RemediationAI

Upgrade pardus-update to version 0.7.0 or later, which is the fixed release (the affected range is 0.6.6 before 0.7.0); apply it through the Pardus repositories via the system package manager. Refer to the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0609 for vendor guidance. Until the update is applied, restrict local access to trusted administrators only and, on multi-user systems, limit or revoke the ability of unprivileged accounts to invoke pardus-update or supply update parameters/inputs it consumes; the trade-off is that legitimate self-service updating by standard users will be blocked. Avoid running the vulnerable version with elevated privileges in shared environments where untrusted local users have shell access.