CVE-2026-8303

CVE-2026-8303 is an incorrect privilege assignment flaw (CWE-266) in Pardus-software, a component of the Pardus Linux distribution developed by Turkey's TUBITAK BILGEM Software Technologies Research Institute. Affected versions before 1.0.5 assign privileges incorrectly, so a local user with low privileges can trigger the flaw with no user interaction required and escalate to higher privileges, likely gaining full control of the system given the high confidentiality, integrity, and availability impact ratings. The CVSS:3.1 local attack vector (AV:L/PR:L/UI:N) means exploitation requires an attacker to already have a foothold, such as a local account or the ability to run code on the machine, rather than remote network access. Anyone running Pardus with a Pardus-software version prior to 1.0.5 is affected. No public proof-of-concept is known, the flaw is not in CISA's KEV catalog, and no in-the-wild exploitation has been reported to date.

What to do: Update Pardus-software to version 1.0.5 or later via Pardus package repositories on all Pardus installations. Until patched, treat multi-user or shared Pardus machines as higher risk, since any local account could potentially escalate privileges. Monitor USOM (TR-CERT) advisories for updates on exploitation status.