# CVE-2026-14460: TUBITAK BILGEM pardus-software argument injection privilege escalation

Source: https://junglewise.ai/threats/cve-2026-14460-tubitak-bilgem-pardus-software-argument-injection-privilege  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-03. Updated: 2026-07-03  
License: CC BY 4.0 with a link back

CVE-2026-14460 · Severity: high · CVSS 8.8 · Published 2026-07-03

A security vulnerability has been identified in the Pardus Software management tool used in the Pardus operating system. An attacker with low-level access to a computer could exploit this flaw to bypass security checks and execute unauthorized commands with elevated privileges. This could lead to a full system takeover, unauthorized data access, or disruption of services on the affected machine.

Vendors: [TUBITAK BILGEM Software Technologies Research Institute](https://junglewise.ai/threats/vendors/tubitak-bilgem-software-technologies-research-institute).

## Quick answers

**Is CVE-2026-14460 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14460 being exploited in the wild.

**How severe is CVE-2026-14460?** High severity, with a CVSS score of 8.8, published 3 July 2026.

**Which products and versions are affected?** TUBITAK BILGEM Software Technologies Research Institute Pardus Software <= 1.0.4 before 1.0.5.

**Is there a fix for CVE-2026-14460?** A patch was published on 2026-07-03: Fixed in version 1.0.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-14460 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-14460?** Check whether you run TUBITAK BILGEM Software Technologies Research Institute Pardus Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing authorization vulnerability (CWE-862) exists in the pardus-software component of the Pardus operating system. The flaw allows a local attacker to perform argument injection due to insufficient validation and authorization checks when handling software management tasks. By exploiting this, a low-privileged user can execute arbitrary commands with the privileges of the software manager, typically root. The issue affects versions up to and including 1.0.4 and is addressed in version 1.0.5.

## Affected products

- TUBITAK BILGEM Software Technologies Research Institute pardus-software <= 1.0.4 before 1.0.5

## Timeline

- 2026-07-03: advisory: CVE published by TR-CERT and NVD
- 2026-07-03: patched: Fixed in version 1.0.5

## References

- [https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0497](https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0497)

## Related threats

- [TUBITAK BILGEM pardus-software argument injection](https://junglewise.ai/threats/cve-2026-14459-tubitak-bilgem-pardus-software-argument-injection)