What is the CVSS score of CVE-2026-5141?

CVE-2026-5141 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Pardus Software Center are affected by CVE-2026-5141?

Pardus Software Center before version 1.0.3 contains a privilege escalation vulnerability (CVE-2026-5141) allowing unprivileged local users to gain complete system control on affected Pardus Linux…. A patch is available.

How to fix or mitigate CVE-2026-5141?

Within 24 hours, inventory all Pardus Linux deployments and identify systems running affected versions of Pardus Software Center; assess exposure to untrusted local user access and notify system owners. Within 7 days, validate Pardus Software Center version 1.0.3 in a test environment to confirm compatibility and operational stability, then begin staged rollout on non-critical systems. Within 30 days, complete deployment of version 1.0.3 or later to all production Pardus Linux systems, prioritizing those with elevated local-user risk.

Pardus Software Center CVE-2026-5141

EUVD-2026-26235 HIGH

Improper Privilege Management (CWE-269)

2026-04-29 TR-CERT

Privilege Escalation Pardus Software Center Tubitak Bilgem Software Technologies Research Institute

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.3 HIGH

Hijacking a local privileged desktop process implies local vector and an authenticated local user (AV:L, PR:L, UI:R); impact is total, so C/I/A:H.

3.1 AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 05:50 vuln.today

Patch released

Apr 29, 2026 - 21:13 nvd

Patch available

Apr 29, 2026 - 16:01 EUVD

EUVD ID Assigned

Apr 29, 2026 - 14:45 euvd

EUVD-2026-26235

CVE Published

Apr 29, 2026 - 14:18 nvd

HIGH 8.8

DescriptionCVE.org

Improper Privilege Management, Improper Access Control, Incorrect privilege assignment vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Software Center allows Hijacking a privileged process.

This issue affects Pardus Software Center: before 1.0.3.

AnalysisAI

Privilege escalation in TUBITAK BILGEM's Pardus Software Center before 1.0.3 allows an attacker to hijack a privileged process, enabling full compromise of confidentiality, integrity, and availability on affected Pardus Linux systems. The flaw stems from improper privilege management (CWE-269) and requires user interaction to trigger, but no prior authentication per the CVSS vector. There is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.04%), consistent with CISA SSVC scoring exploitation as 'none'.

Technical ContextAI

Pardus Software Center is the graphical application-management/software-installation front-end shipped with Pardus, a Debian-based Linux distribution developed by TUBITAK BILGEM (Türkiye's national scientific research institute). Software centers of this type routinely broker privileged operations (package install/removal, repository configuration) through a helper process or policy mechanism that runs with elevated rights. The root cause here belongs to CWE-269 (Improper Privilege Management), and the EUVD/NVD classification also cites Improper Access Control and Incorrect Privilege Assignment - indicating that the privileged backend process does not correctly enforce which caller or operation is authorized, allowing a lower-privileged user action to 'hijack' that privileged process. The single CPE, cpe:2.3:a:tubitak_bilgem_software_technologies_research_institute:pardus_software_center:*, confirms the application itself (not the underlying OS) as the vulnerable component.

RemediationAI

Upgrade Pardus Software Center to version 1.0.3 or later, which the vendor lists as the fixed release (Patch available per vendor advisory; the input specifies fixed version 1.0.3 as the first unaffected release). Apply the update through Pardus's standard package channels and consult the TR-CERT/USOM advisory at https://www.usom.gov.tr/bildirim/tr-26-0131 (also mirrored at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0131) for distribution-specific instructions. Until 1.0.3 is deployed, reduce exposure by restricting who can launch or interact with the Software Center on multi-user systems and by avoiding running it in untrusted sessions, since exploitation requires user interaction to trigger the privileged process; note the trade-off that limiting access to the Software Center also limits legitimate self-service software installation for standard users.