EUVD-2026-76114
GHSA-6h27-fj47-54hm
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access required with a standard user account; low complexity once on-host; full system impact but no scope change, consistent with a privilege escalation to root.
Primary rating from Vendor (TR-CERT).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Incorrect privilege assignment vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus-software allows Privilege Escalation.
This issue affects Pardus-software: before 1.0.5.
AnalysisAI
Local privilege escalation in Pardus-software (the software center for TUBITAK BILGEM's Pardus Linux distribution) allows a low-privileged local user to gain full system control. The flaw stems from incorrect privilege assignment (CWE-266), where the application grants elevated permissions to processes or objects that should operate with restricted rights, enabling an authenticated local user to escalate to root or equivalent. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local user account on a Pardus Linux system running Pardus-software before version 1.0.5 - specifically, the attacker must be authenticated with at minimum a standard (low-privilege) account (PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is moderate-high for environments running Pardus Linux. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Pardus-software to version 1.0.5 or later, which is the vendor-confirmed fix version per TR-CERT advisory TR-26-1080 (https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1080). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, generate a complete inventory of systems running Pardus-software and audit all active local user accounts; disable unnecessary accounts and restrict shell access to designated administrators only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Pardus Software
View allLocal privilege escalation via argument injection in TUBITAK BILGEM's pardus-software (the software-center application f
Local privilege escalation via argument injection in TUBITAK BILGEM's pardus-software (the Pardus Linux application/soft
Same weakness CWE-266 – Incorrect Privilege Assignment
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today