Pardus-software CVE-2026-8303

Exploitation requires a local user account on a Pardus Linux system running Pardus-software before version 1.0.5 - specifically, the attacker must be authenticated with at minimum a standard (low-privilege) account (PR:L). No network access is required (AV:L). No user interaction by another party is needed (UI:N), and no special configuration beyond the default installation of the vulnerable software is described. Limiting factors: the attacker must have local shell or session access to the target host; remote unauthenticated exploitation is not possible based on the AV:L vector. Scope is contained to the vulnerable system (S:U), so lateral movement to other systems is not a direct consequence of the vulnerability itself.

Real-world risk is moderate-high for environments running Pardus Linux. The CVSS 7.8 score is appropriate: the AV:L constraint limits exposure to attackers who already have local shell access (e.g., a logged-in user or a process that has achieved code execution at low privilege), but AC:L/PR:L/UI:N indicates exploitation is straightforward once that foothold exists. No KEV listing and no public POC have been identified, which reduces urgency for most environments. EPSS data is absent from the input. Because Pardus is deployed in Turkish government and public sector infrastructure, successful exploitation in such environments could yield significant impact - full host compromise (C:H/I:H/A:H) from a standard user account. The narrow geographic and sector deployment footprint limits broad internet-scale risk. The reference advisory TR-CERT TR-26-1080 provides the sole public documentation; no secondary vendor or NVD CPE version details refine the affected range beyond 'before 1.0.5'.

A low-privileged user logged into a Pardus Linux workstation launches Pardus-software or interacts with its backend service in an unintended way that triggers the incorrect privilege assignment. The user's process inherits or is granted elevated privileges - potentially root - due to the misconfigured privilege model, giving full read/write/execute access across the system. No public POC has been identified, but the low complexity (AC:L) indicates exploitation would be straightforward for an attacker with shell access.