What is the CVSS score of CVE-2026-6509?

CVE-2026-6509 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Pardus Update are affected by CVE-2026-6509?

Pardus Update (versions ≤0.6.3), the system update component in TÜBİTAK BİLGEM's Pardus Linux distribution, contains a missing authorization flaw allowing any local user to escalate to root-level…. A patch is available.

How to fix or mitigate CVE-2026-6509?

Within 24 hours: Inventory all systems running Pardus Update version 0.6.3 or earlier and restrict local user access to authorized administrators only. Within 7 days: Verify vendor availability of Pardus Update version 0.6.6 (stated to contain fix) and deploy to test environment. Within 30 days: Deploy version 0.6.6 across all production Pardus systems after validation; audit privilege escalation logs (/var/log/auth.log) for exploitation evidence on previously vulnerable systems.

Pardus Update CVE-2026-6509

EUVD-2026-41767 HIGH

Missing Authorization (CWE-862)

2026-07-05 iletisim@usom.gov.tr

GHSA-fcx2-pfmg-pwvq

Authentication Bypass Privilege Escalation

7.8

CVSS 3.1 · Vendor: usom

Severity by source

Vendor (usom) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Missing authorization on a root update helper reachable only by an authenticated local user (AV:L, PR:L), reliably triggered without interaction (AC:L, UI:N), yielding full root compromise (C/I/A:H).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (usom).

CVSS VectorVendor: usom

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 05, 2026 - 16:01 EUVD

Analysis Generated

Jul 05, 2026 - 15:31 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Update allows Privilege Escalation.

This issue affects Pardus Update: from <=0.6.3 before 0.6.6.

AnalysisAI

Local privilege escalation in Pardus Update (versions <=0.6.3, fixed in 0.6.6), the software-update component of TÜBİTAK BİLGEM's Debian-based Pardus Linux distribution, allows a low-privileged local user to perform actions they should not be authorized for and escalate to root-level control. The CWE-862 Missing Authorization flaw carries CVSS 7.8 with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Pardus Update is the update/package-management front-end shipped with Pardus, a Turkish national Linux distribution derived from Debian and developed by TÜBİTAK BİLGEM Software Technologies Research Institute. The root cause is CWE-862 (Missing Authorization): a privileged operation - most plausibly a D-Bus service, PolicyKit action, or setuid/helper backend that performs package or system updates as root - fails to verify that the calling user is entitled to invoke it. Because update tooling routinely runs with elevated rights to write to system paths and install packages, an authorization gap in that trusted path lets an unprivileged caller reach root-level functionality. No CPE strings were supplied in the input, so exact affected package identifiers must be confirmed from the Pardus/TÜBİTAK advisory.

RemediationAI

Vendor-released patch: Pardus Update 0.6.6 - upgrade all affected hosts to version 0.6.6 or later via the standard Pardus package repositories, which is the primary and complete fix. Consult the advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0501 for exact package names and update instructions. Where immediate patching is not possible, compensating controls should target local access to the vulnerable component: restrict interactive and shell access on affected systems to trusted administrators only (reducing the pool of local accounts that can reach the flaw), and if operationally acceptable temporarily restrict or disable the Pardus Update service/helper for non-admin users - with the trade-off that end users lose self-service update capability and must rely on administrator-driven patching. Because no CPE or component-level detail was provided, validate the exact service or PolicyKit action to constrain against the vendor advisory before applying service-level restrictions.