PDKS CVE-2026-7402

Attacker must possess valid PDKS user credentials with low-privilege access (PR:L)-standard employee accounts sufficient, administrative access not required. Exploitation succeeds against PDKS versions V16.20200313 through pre-VMYR_3.5.2025117 in default network-accessible configurations. No special PDKS features, modules, or configuration settings required; the vulnerability exists in core request-handling logic across all deployment modes. Limiting factors: authentication barrier prevents anonymous internet-wide attacks (contrast with PR:N scenarios); attacker must be insider, compromised account holder, or have stolen credentials through phishing/breach. Network-level rate limiting, WAF protections, or custom throttling middleware would prevent exploitation. Organizations with PDKS deployed on isolated internal networks (no VPN/remote access) face reduced risk limited to physical on-premises attackers.

Moderate-to-high real-world risk for organizations using PDKS in Turkey and regional markets. The CVSS 8.1 score reflects legitimate severity: network-accessible flooding by low-privilege authenticated users (PR:L) can disrupt critical workforce tracking operations and corrupt time/attendance records. The low attack complexity (AC:L) means basic scripting knowledge enables exploitation. However, several factors moderate urgency: authentication requirement (PR:L) limits attack surface to credential holders (employees, contractors, or compromised accounts), no confirmed active exploitation (not in CISA KEV), and no publicly available proof-of-concept code identified. The TR-CERT advisory suggests regional awareness but limited global exposure. Primary risk is operational disruption in production PDKS deployments where workforce tracking is business-critical (manufacturing, healthcare, government). Organizations NOT using this specific Turkish personnel management system face zero risk. The vulnerability class (rate-limiting failure) is typically easier to exploit than memory corruption but harder to chain into full system compromise.

An authenticated attacker with low-privilege PDKS credentials (standard employee account) writes a simple Python script using the requests library to flood vulnerable PDKS API endpoints with thousands of concurrent personnel record queries or time-entry submissions. The application's lack of rate limiting allows the script to overwhelm server resources within minutes, causing legitimate users to experience timeouts and preventing critical workforce operations like shift check-ins. Simultaneously, the attacker submits contradictory time-entry records at high frequency, exploiting race conditions to corrupt attendance databases and create payroll calculation discrepancies. No specialized tools required beyond basic HTTP libraries.