CVE-2026-7863

OS Command Injection in TUBITAK BILGEM's Pardus Software

View on CVE.org
Published Sep 11, 2026 CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Description
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Software allows OS Command Injection.

This issue affects Pardus Software: before 1.0.5.

Analysis

AI-generated

Technical impact

The vulnerability is an OS command injection flaw (CWE‑78) in TUBITAK BILGEM Software Technologies Research Institute’s Pardus Software that results from improper neutralization of special elements used in an OS command execute arbitrary operating‑system commands. Based on the description, it is inferred that such arbitrary command execution can compromise the confidentiality, integrity, and availability of the affected system.

Affected Systems

TUBITAK BILGEM Software Technologies Research Institute’s Pardus Software versions prior to 1.0.5.

Risk and Exploitability

The CVSS score of 8.4 indicates high severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation yet. The likely attack vector would involve an attacker providing crafted input that reaches the vulnerable component, which could be possible remotely or locally by an unprivileged user; the exact prerequisites are not explicitly stated in the description.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Pardus Software to version 1.0.5 or newer to apply the vendor patch that eliminates the command injection flaw.
  • If an upgrade is not immediately feasible, limit the privileges of the component that constructs the OS command, ensuring it runs with the least privilege required.
  • Sanitize or validate all external input before it is used to build or execute shell commands, escaping shell metacharacters to prevent injection.
  • Audit the system for signs of unauthorized command execution and monitor logs for anomalous activity that could indicate exploitation.

Generated by OpenCVE AI on September 11, 2026 at 18:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Tubitak Bilgem Software Technologies Research Institute
Tubitak Bilgem Software Technologies Research Institute pardus-software
Vendors & Products Tubitak Bilgem Software Technologies Research Institute
Tubitak Bilgem Software Technologies Research Institute pardus-software
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Software allows OS Command Injection. This issue affects Pardus Software: before 1.0.5.
Title OS Command Injection in TUBITAK BILGEM's Pardus Software
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}
Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Sources

Status
PUBLISHED
Assigner
TR-CERT
Published
Updated
Sep 11, 2026, 4:26 PM
Reserved
May 5, 2026, 12:18 PM

View source JSON

Updated
Sep 11, 2026, 4:25 PM

JSON

Status
Deferred
Published
Sep 11, 2026, 4:17 PM
Modified
Sep 11, 2026, 5:35 PM

View source JSON

No data.

Updated
Sep 11, 2026, 8:45 PM

JSON