What is the CVSS score of CVE-2026-9085?

CVE-2026-9085 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Pardus Parental Control are affected by CVE-2026-9085?

A privilege escalation vulnerability in Pardus-Parental-Control (versions ≤0.5.1) allows low-privileged local users to manipulate system-wide DNS settings, bypassing parental controls and enabling…. A patch is available.

How to fix or mitigate CVE-2026-9085?

Within 24 hours: Identify and document all systems running Pardus-Parental-Control with affected versions (≤0.5.1). Within 7 days: Upgrade all affected installations to version 0.7.0. Within 30 days: Validate upgrades across all managed endpoints and review audit logs for any unauthorized DNS configuration changes.

Pardus Parental Control CVE-2026-9085

EUVD-2026-41765 HIGH

Incorrect Permission Assignment for Critical Resource (CWE-732)

2026-07-05 TR-CERT

GHSA-686q-wrh7-cph5

Information Disclosure Pardus Parental Control Tubitak Bilgem Software Technologies Research Institute

8.8

CVSS 3.1 · Vendor: TR-CERT

Severity by source

Vendor (TR-CERT) PRIMARY

8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Local, low-complexity abuse by an unprivileged user (AV:L/AC:L/PR:L); the permission flaw lets tampering alter system-wide DNS, justifying scope change and high C/I/A.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (TR-CERT).

CVSS VectorVendor: TR-CERT

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 05, 2026 - 16:01 EUVD

Analysis Generated

Jul 05, 2026 - 15:20 vuln.today

DescriptionCVE.org

Incorrect Permission Assignment for Critical Resource, Improper Access Control vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus-Parental-Control allows DNS Spoofing.

This issue affects Pardus-Parental-Control: from <=0.5.1 before 0.7.0.

AnalysisAI

Local privilege abuse in TUBITAK BILGEM Pardus-Parental-Control (versions up to and including 0.5.1, fixed in 0.7.0) lets a low-privileged local user exploit insecure file/resource permissions to tamper with the tool's DNS configuration and perform DNS spoofing. Because the CVSS scope is changed (S:C), the impact reaches beyond the application to system-wide name resolution, enabling redirection of traffic, bypass of parental filtering, and interception of connections. There is no public exploit identified at time of analysis, but the reachable local vector and low complexity make this a practical concern on shared or managed Pardus endpoints.

Technical ContextAI

Pardus Parental Control is a content-filtering/parental-supervision utility developed for the Pardus Linux distribution by TUBITAK BILGEM's Software Technologies Research Institute. The root cause is CWE-732 (Incorrect Permission Assignment for Critical Resource): a critical resource - most plausibly the application's DNS/filter configuration file, service, or a helper writable component - is assigned permissions that are too permissive, allowing an unprivileged local account to modify it. Since parental-control tools enforce policy by controlling DNS resolution, an attacker who can rewrite the DNS settings governs which upstream resolver the host trusts, which is the mechanism behind the DNS spoofing outcome. The affected CPE is cpe:2.3:a:tubitak_bilgem_software_technologies_research_institute:pardus-parental-control, a distribution-specific desktop application rather than a network service.

RemediationAI

Upgrade to Pardus-Parental-Control 0.7.0 or later, which is the vendor-designated fixed release, as documented in the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0500. Where an immediate upgrade is not possible, restrict interactive local access to managed endpoints and audit and tighten the file-system permissions on the application's configuration and DNS-related resources so that only root/administrative accounts can write them, removing group- or world-writable bits - the trade-off is that manual permission changes may be reverted by the application on restart or break its self-update, so re-verify after each run. Additionally, protecting the system DNS configuration (for example enforcing resolver settings via a root-owned mechanism and monitoring for unauthorized changes) limits the DNS-spoofing impact until patching is complete.