# CVE-2026-9085: TUBITAK BILGEM Pardus-Parental-Control DNS spoofing via improper access control

Source: https://junglewise.ai/threats/cve-2026-9085-tubitak-bilgem-pardus-parental-control-dns-spoofing-via-improper  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-05. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2026-9085 · Severity: high · CVSS 8.8 · Published 2026-07-05

Pardus-Parental-Control is a software tool used to manage and restrict internet access for users on the Pardus operating system. A security flaw in how the software manages file permissions allows a local user to bypass web filters and redirect internet traffic to malicious websites. This could lead to the theft of login credentials or the installation of malware on the affected system.

Vendors: [TUBITAK BILGEM Software Technologies Research Institute](https://junglewise.ai/threats/vendors/tubitak-bilgem-software-technologies-research-institute).

## Quick answers

**Is CVE-2026-9085 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9085 being exploited in the wild.

**How severe is CVE-2026-9085?** High severity, with a CVSS score of 8.8, published 5 July 2026.

**Which products and versions are affected?** TUBITAK BILGEM Software Technologies Research Institute Pardus-Parental-Control >=0.5.1, <0.7.0.

**Is there a fix for CVE-2026-9085?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-9085 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-9085?** Check whether you run TUBITAK BILGEM Software Technologies Research Institute Pardus-Parental-Control at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in Pardus-Parental-Control versions 0.5.1 through 0.6.x (fixed in 0.7.0) due to incorrect permission assignments (CWE-732) and improper access control (CWE-284). A local attacker with low privileges can exploit these weak permissions to modify critical system resources, specifically enabling DNS spoofing. By redirecting DNS queries, the attacker can intercept or manipulate network traffic. The vulnerability is characterized by a CVSS 3.1 score of 8.8, noting a scope change (S:C) which indicates the impact extends beyond the parental control application to the broader system network security.

## Affected products

- TUBITAK BILGEM Software Technologies Research Institute Pardus-Parental-Control >=0.5.1, <0.7.0

## Timeline

- 2026-07-05: advisory: CVE-2026-9085 published by TR-CERT and NVD
- 2026-07-05: disclosed

## References

- [https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0500](https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0500)